This question already has an answer here:
I'm still trying to understand the functionality of a Certificate Authority, so if this obvious, I apologize.
I understand CRLs play a role when the CA wants to invalidate a certain SSL certificate. In every SSL certificate I checked, both OCSP and CRL URLs are served in plain HTTP. Is there any particular reason to distribute them over HTTP?
The chances of someone stealing a server private key and spoofing the clients connection to the CA's servers are quite slim, but I'm wondering if there is nay accessibility or technical reason behind that.
As always, thank you for your attention and time