The certificate revocation list (CRL) is a signed list that is published and maintained by each certification authority (CA) that lists all of its revoked certificates that are still within their validity dates. When a CA revokes a certificate, the CA administrator (CAA) prepares a new CRL and posts it to the directory server. The CRL has additional fields, including the reason for revocation and the date and time of the next update. When a consumer requests access to a resource, the resource can allow or deny access based on the CRL entry for the issuer of the certificate of that particular consumer.

Figure 1 – An example of a CRL being consumed by a certificate revocation service.

Figure 1 illustrates a CRL checking process that checks the serial number of a certificate against the certificate issuer’s CRL. If the certificate’s serial appears on the CRL, it means it is revoked. For example, certificates may be revoked if the owner’s private key has been lost, has left the company or agency, or their name changes. CRLs document the historical revocation status of certificates so that, for instance, a dated signature may be presumed to be valid if the signature date was within the validity period of the certificate, and the current CRL of the issuing CA at that date did not show the certificate to be revoked.

Related Patterns:

• Cloud Authentication Gateway
• Cloud Authentication Gateway
• Federated Cloud Authentication

This mechanism is covered in CCP Module 7: Fundamental Cloud Security and
in Module 8: Advanced Cloud Security.

For more information regarding the Cloud Certified Professional (CCP) curriculum, visit www.arcitura.com/ccp.

This cloud computing mechanism is also covered in:

Cloud Computing Design Patterns by Thomas Erl, Robert Cope, Amin Naserpour

(ISBN: 9780133858563, Hardcover, ~ 528 pages)

For more information about this book, visit www.arcitura.com/books.