I know that modern web browsers don't check CRLs for certificates from CAs in the default trust store anymore. I also know that there are some exceptions for certificate validation when it comes to corporation / enterprise PKIs. For example for the lifetime of a certificate, optional certificate features like issuer policy and so on.

Since I came into an argument if OCSP responder are required in an corporate/enterprise PKI, my question is:

Do current Browsers (Edge, Chrome, Firefox, Safari) in 2023 still check CRLs of webserver and SubCA certificates to determine their certificate validity, if no AIA/OCSP distribution points are specified and the certificates are issued by an corporate/entterprise pki RootCA?

This does not ask the question if the certificates are considered valid. (They are) I ask if the CRL distribution points actual affect the certificate validity.

1 Answer 1


Chrome/Chromium/Edge can be configured to check OCSP and CRL, but they don't by default. These are options for Webkit based browsers, so the list might be longer than those three.

Firefox checks OCSP, but not CRLs. This can't be configured as far as I'm aware.

  • 1
    Ok, great. From the Mozilla link we can assume that classic CRLs will never be processed. If the PKI operator want to provide certificate revocation, they have to provide an OCSP resolver. Mar 16 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.