A Certificate Revocation List is a signed data file published by a certificate authority that lists certificates that are no longer trusted before their normal expiration date. Each revoked certificate is identified by details such as its serial number, and clients can download the list to verify whether a TLS certificate has been withdrawn. Because the list is signed, a client can check that it really came from the issuing authority and was not altered in transit.
CRLs matter because revocation is part of the trust model behind HTTPS, VPNs, code signing, and other PKI-based systems. In defense, organizations use CRLs to stop accepting compromised, misissued, or no-longer-valid certificates. In real operations, strict CRL checking can also cause outages if clients cannot reach the CRL distribution point, or if a revoked certificate has not been replaced quickly. Security teams therefore monitor CRL availability, automate certificate rotation, and test how clients behave when revocation status changes.