What is crl And why Should it be revoked
A certificate revocation list (CRL) is a time-stamped listidentifying revoked certificates that is signed by a CA or CRL issuerand made freely available in a publicrepository.Each revoked certificate is identified in a CRL by itscertificate serial number.
When a certificate-using system uses a certificate (e.g., for verifying a remote user's digital
signature), that system not only checks the certificate signatureand validity but also acquires a suitably recent CRL and checks hat the certificate serial number is not on that CRL.
The meaning of "suitably recent" may vary with local policy, but it usuallymeans the most recently issued CRLA new CRL is issued on a regular periodic basis (e.g., hourly, daily, or weekly).
An entryis added to the CRL as part of the next update following notification of revocation. An entry MUST NOT be removed from the CRL until it appears on one regularly scheduled CRL issued beyondthe revoked certificate's validity period.
An advantage of this revocation method is that CRLs may be distributed by exactly the same means as certificates themselves, namely, via untrusted servers and untrusted communications.
CRl's would revoke when private key of an asymmetric encryption key pair (whose public key has been certified by the CA) is stolen.In such a situation, anybody with the private key could decrypt all communication between a user and the certified entity.
CRLs Will be issued periodically, in which case certificates that have expired may be tagged as revoked, or they may be issued as soon as a certificate is revoked. To keep CRLs from being faked, they are signed by the public key of the CA and contain a timestamp, after which the CRLs themselves expire.
Reasons for revocation :
According to ietf the common reasons for revocation were :