thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

CRL vs OCSP: What's the Difference?

A CRL is a signed list of revoked certificate serial numbers that clients download periodically, while OCSP lets a client query the status of a single certificate in near real time. OCSP stapling lets the server attach a fresh signed OCSP response itself.

Certificate Revocation List (CRL)

Full definition
vs

Online Certificate Status Protocol (OCSP)

Full definition
Certificate Revocation ListOnline Certificate Status Protocol
FormatFull list of revoked serial numbersRequest/response for one certificate
FreshnessOnly as current as the last publicationNear real time
BandwidthCan be large to downloadSmall per query
PrivacyClient does not reveal which site it visitsResponder learns which certificate is checked (unless stapled)
LoadSpread over cached downloadsResponder must answer every query unless stapling is used
EnhancementDelta CRLsOCSP stapling
Remember it

CRL is the whole blacklist; OCSP is asking about one name.

Exam tip

Questions that emphasize real-time checking or reducing download size point to OCSP. Questions about reducing load on the CA and privacy leaks point to OCSP stapling.

Tested on

More Security Fundamentals & Crypto look-alikes