Certificate revocation list
File type: Encoded and encrypted file
A crl file extension identifies a Certificate Revocation List (CRL), a signed list of digital certificates that a certificate authority has revoked before their normal expiration.
CRL files are used by OpenSSL and by certificate validation on Microsoft Windows, including Internet Information Services (IIS).
File type category:
Encoded and encrypted file
Date updated: October 28, 2026
A Certificate Revocation List is a published, digitally signed record from a certificate authority. It identifies revoked certificates by their serial numbers and normally includes the revocation date and, when provided, the reason for revocation. The CRL also identifies its issuer and includes dates such as the time it was issued and when the next update is expected.
Certificate-validation software downloads or obtains a CRL from a certificate distribution point and checks whether a certificate appears on it. A CRL is one established method of checking certificate status; Online Certificate Status Protocol (OCSP) provides another method by querying status information without distributing the complete list. CRLs can become out of date, so a current update is needed when the listed next-update time is reached.
The format is supported by OpenSSL on multiple platforms. On Microsoft Windows, Internet Information Services uses the Windows certificate infrastructure for certificate validation and revocation checking. A CRL may be encoded as PEM text or as binary DER data, and the .crl extension alone does not identify which encoding it uses. Common MIME types include application/pkix-crl and application/pkcs-crl.
Use OpenSSL to inspect a CRL on Windows, macOS, Linux, or another supported platform. The OpenSSL CRL command can display the issuer, validity dates, revoked certificate serial numbers, and revocation reasons. Specify DER input when the file is binary; PEM is the usual text encoding.
On Microsoft Windows, a CRL can also be handled by the Windows certificate infrastructure used by Internet Information Services (IIS). IIS generally consumes CRLs during certificate validation rather than opening them as documents.
A CRL is not normally converted into another document format. If necessary, OpenSSL can re-encode the same CRL between PEM and DER; this changes its encoding, not its certificate-status information. A CRL cannot be converted into a certificate or an OCSP response.
Englishapplication/pkix-crlSoftware applications that can open crl files:
Microsoft Windows
Multiplatform
Software apps that create crl files:
Microsoft Windows
Multiplatform
