Revocation is separate evidence
05A CRL is signed, time-bounded status information issued by an authorized CRL issuer.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 6.3 ↗
RFC 5280 · § 6.3EXAMPLE
3 / 3
03
Look up the serial
A matching revocation entry changes the certificate’s status.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Validate the CRL issuer, signature, scope, and applicable times.
- Validate the CRL issuer, signature, scope, and applicable times.
- A listed certificate serial number can indicate revocation.
- An unavailable or inapplicable CRL is not proof that a certificate is good.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy