What is the CRL file format?
Files with the .crl extension are used in digital certificate technology and public key infrastructure (PKI).
What do CRL files contain?
The content of .crl files are certificate revocation lists. These are used by web servers and PKI systems to ensure secure communication on the Internet. Certificate revocation lists stored in .crl files enumerate certificates that have been revoked, for example due to the disclosure of the private key used to create the certificate, or because the certificate holder's status has changed. .crl files contain information about each certificate's serial number, its revocation date, and the issuer's distinguished name. Certificates listed in .crl files can be in two states:
- Suspended, with the option of restoration,
- Revoked, without the possibility of renewal.
The decision to add a specific certificate to a .crl is made by its issuer - the Certificate Authority (CA). Thanks to .crl files, administrators are able to effectively restrict network traffic generated by entities that have lost their certification.
How are CRL files encoded?
.crl files are encoded in ASN.1 format and exist in two encodings: binary DER (Distinguished Encoding Rules) or text-based PEM (Base64-wrapped DER enclosed between -----BEGIN X509 CRL----- and -----END X509 CRL----- markers). Binary DER is the most common form. A .cer certificate from the same CA is required to verify the CRL's digital signature before trusting its contents.
CRL distribution and alternatives
CAs publish .crl files at URLs listed in the CRL Distribution Points (CDP) extension of each end-entity certificate. Delta CRLs list only changes since the last full CRL, reducing download sizes for large CAs whose complete lists can reach several megabytes. OCSP (Online Certificate Status Protocol) enables per-certificate real-time revocation checks without downloading the full list, but .crl files remain mandatory in many enterprise and government PKI environments.
Security & safety
RISK: LOWCRL files are read-only PKI metadata signed by a trusted CA; they pose no execution risk. A forged or outdated CRL could lead a system to trust revoked certificates, but that is a PKI configuration issue, not a file safety concern. Always fetch CRLs from the CDP URLs embedded in certificates or from the CA's official LDAP/HTTP endpoints.
Format details
in a nutshell- Windows Certificate Store CRL cache - Windows stores downloaded CRLs in the system certificate store; same DER format, accessed via CryptoAPI/certutil.
Programs that open CRL files
Windows2 apps
OpenSSL for Windows (Win64 OpenSSL)
Open-source Run: openssl crl -in file.crl -inform DER -text -noout (add -inform PEM for PEM CRLs) 
macOS2 apps
Keychain Access (built-in)
Built-in Double-click a CRL file to add it to the Keychain; or drag into Keychain Access for inspection. 
Linux1 app
Technical details
deep spec| Encoding formats | Binary DER (Distinguished Encoding Rules) or Base64-wrapped PEM |
| Byte order | Big-endian (ASN.1 DER) |
| MIME type | `application/pkix-crl` (DER); `application/x-pkcs7-crl` (PKCS#7 wrapped variant) |
| Magic bytes (DER) | `0x30 0x82` at offset 0 - ASN.1 SEQUENCE tag followed by length encoding |
| PEM markers | Wrapped between `-----BEGIN X509 CRL-----` and `-----END X509 CRL-----` |
| Standard | X.509 v2 CRL; IETF RFC 5280 |
| Core structure | TBSCertList: issuer DN, thisUpdate/nextUpdate timestamps, list of serial numbers with revocation dates and reason codes |
| Revocation reason codes | RFC 5280 CRLReason: keyCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL |
| Signature | CA digital signature (RSA, ECDSA, or DSA) over TBSCertList; must be verified against the CA certificate |
| Delta CRL support | BaseCRLNumber extension marks a delta CRL listing only incremental changes since the base CRL |
| Distribution mechanism | CRL Distribution Points (CDP) X.509 extension in end-entity certificates holds the download URL |
| Typical file size | 1 KB - 5 MB (scales with number of revoked certificates per CA) |
| Real-time alternative | OCSP (RFC 6960) provides per-certificate revocation status without downloading the full CRL |
| Released | 1988 (X.509 v1 CRL); v2 CRL defined in RFC 2459 (1999), updated RFC 5280 (2008) |
| Latest version | X.509 v2 CRL (RFC 5280, 2008) |
| Open standard | Yes · royalty-free |
| Specification | www.ietf.org |
CRL conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CRL files.
