Contents
How does CRL revocation work?
The access point sends the certificate to the RADIUS server, which checks if it is expired or not. If it’s still valid, the RADIUS checks the directory (such as Active Directory) of approved users. If the user is approved, the RADIUS checks the CRL to confirm that their certificate has not been revoked.
What is a CRL in PKI?
A Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing Certificate Authority (CA) before their scheduled expiration date and should no longer be trusted.
Why is a certificate revocation list ( CRL ) necessary?
The CRL is populated by a certificate authority (CA), another part of the PKI. Importantly, only the CA that issued the certificate has the power to revoke it and place it on the CRL. Why is a Certificate Revocation List Necessary? Without a CRL, there’s no way for the PKI to know whether a certificate has been revoked before its expiration.
Why is a CRL important in a PKI?
A CRL is an important component of a public key infrastructure (PKI), a system designed to identify and authenticate users to a shared resource like a Wi-Fi network. The CRL is populated by a certificate authority (CA), another part of the PKI. Importantly, only the CA that issued the certificate has the power to revoke it and place it on the CRL.
How to check the status of a CRL certificate?
To check the status of a certificate using a CRL, the client reaches out to the CA (or CRL issuer) and downloads its certificate revocation list. After doing this, it then must search through the entire list for that individual certificate. This is not only cumbersome but it’s also slow.
What does a CRL mean in Internet engineering task force?
But it’s more than that. The more technical answer from the Internet Engineering Task Force’s (IETF) RFC 5280 describes a CRL as a time-stamped and signed data structure that a certificate authority (CA) or CRL issuer periodically issues to communicate the revocation status of affected digital certificates.