SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-crl-list

What is a certificate revocation list (CRL)?

A signed list of revoked certificates, identified by serial number.

Start playing free

  1. A list of trusted root certificates
  2. A list of users allowed to request certificates
  3. A signed, time-stamped list of revoked certificates ✔

Why: If a certificate is stolen or issued by mistake, the CA revokes it and publishes the serial number in a CRL. Clients check the list before trusting a certificate.

Huh, didn't know that: RFC 5280 says each revoked certificate is identified in a CRL by its certificate serial number.

The dad joke
My identity got stolen. They returned it with a note: "No thanks."
Like this card?
Play the game

References

Answer: A signed, time-stamped list of revoked certificates. If a certificate is stolen or issued by mistake, the CA revokes it and publishes the serial number in a CRL. Clients check the list before trusting a certificate.

  1. RFC 5280, Internet X.509 PKI Certificate and CRL Profile www.rfc-editor.org/rfc/rfc5280
    A CRL is a time-stamped list identifying revoked certificates that is signed by a CA or CRL issuer
    Checked 2026-10-10.
  2. RFC 5280, Internet X.509 PKI Certificate and CRL Profile www.rfc-editor.org/rfc/rfc5280
    Each revoked certificate is identified in a CRL by its certificate serial number.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich protocol lets software check the revocation status of a certificate online, more timely than CRLs?Security & PrivacyWhich key does a recipient use to verify a digital signature?Security & PrivacyWhat do you send to a certificate authority to request a certificate?

That's stuff everyone should know.