CRL (Certificate Revocation List) and OCSP stapling (Online Certificate Status Protocol stapling) are both methods for checking the validity of digital certificates, but they work differently and have distinct advantages and drawbacks.
CRL (Certificate Revocation List)
- How it works: A Certificate Authority (CA) periodically publishes a list of revoked certificates. Clients download this list and check whether a certificate is revoked.
- Pros:
- Can be cached and used offline.
- Avoids real-time network dependency.
- Cons:
- Lists can become large, increasing bandwidth usage.
- Revocation status is only updated periodically, leading to delays.
OCSP Stapling
- How it works: Instead of clients querying the CA directly, the web server fetches the OCSP response and “staples” it to the TLS handshake, providing real-time revocation status.
- Pros:
- Faster validation since clients don’t need to contact the CA.
- Reduces privacy concerns (clients don’t expose their browsing behavior to the CA).
- Cons:
- Requires server-side support.
- Can introduce latency if the OCSP responder is slow.