Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How does certificate revocation list (CRL) work? How can I send a request to the CA to add my current private key to the CRL, so no one except me can add my certificate to the CRL?

- How can we get CA's public key?
- I've got my private key compromised. How does CRL work?
- What happens when a root CA has its private key compromised?

share|improve this question
up vote 2 down vote accepted

That depends on the concrete CRL.

As long as you have access to your private key, you can sign the revocation request. This prevents anyone without access to the private key from issuing a faked revocation request.

With access to the private key, a faked revocation request can be sent. But in this case the damage is already done, and a revocation is actually helping the victim.

share|improve this answer
That makes sense. What protocol is used for CRL? – evening Nov 15 '13 at 13:23
@evening Did you do any research before asking all your similar questions? Several places, including Wikipedia's "Revocation list" article give you that information and/or link to related RFCs. You might also want to check on Wikipedia's "Online Certificate Status Protocol" article for more infos. Hope that helps… – e-sushi Nov 16 '13 at 15:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.