Glossary
Certificate Revocation List
A certificate revocation list is a published list of certificates that have been explicitly revoked before their normal, stated expiry date — a certificate that was compromised, mis-issued, or otherwise shouldn't be trusted anymore, despite the expiry date printed on it still being in the future. A verifier checking a certificate's validity is supposed to consult this list, not just the certificate's own expiry, since a certificate can look perfectly valid by its own metadata while actually having been revoked.
The practical weakness is freshness: the list has to actually be downloaded, and downloading a large, frequently updated list on every single verification is expensive, which pushes real-world systems toward checking it periodically rather than on every single use — reopening the exact same freshness-versus-performance tradeoff that shows up everywhere else caching does, applied specifically to revocation status.