What is CRL?

A CRL (Certificate Revocation List) is a list, signed by a certificate authority, of certificates that must no longer be accepted even though they haven't expired yet.

Certificates are often valid for years, but access sometimes has to end sooner: an employee leaves, a laptop is stolen, a private key leaks. The CA can't recall a certificate it has already issued, so instead it publishes a list of revoked serial numbers, signs it, and every server checks incoming certificates against that list. Because it's signed, the CRL can be copied anywhere without being tampered with, and it contains nothing secret. A CRL also has its own validity period: after its "next update" date, servers treat it as stale.

Two operational details catch people out. First, a server must be able to read the CRL whenever it checks a certificate; a VPN server that has dropped its privileges can't read a file only root can, and then refuses everyone. Second, an expired CRL makes many servers, including OpenVPN, reject every new connection, so CRLs need regenerating on a schedule even when nobody has been revoked. Revoking also doesn't end sessions that are already connected. The OpenVPN on Debian lesson shows all three in a real lab.