How to check a certificate revocation list using OpenSSL

Certificate revocation lists let a certificate authority publish certificates that should no longer be trusted before their normal expiry date. Checking a CRL with OpenSSL helps before publishing revocation material, debugging a client trust decision, or confirming why a certificate fails validation.

The openssl crl command reads the revocation list itself, while openssl verify applies that list during certificate validation. Use the CA certificate that issued both the target certificate and the CRL, because a revocation list from another issuer does not prove the target certificate's status.

PEM files named ca.crt, ca.crl, and server.crt keep the command path readable. Use the same command structure with your own file names as long as the CRL is current and the serial number from the target certificate can be compared with the CRL entries.

1. Print the CRL issuer and update window.

   $ openssl crl -in ca.crl -noout -issuer -lastupdate -nextupdate
   issuer=CN=Example Root CA
   lastUpdate=Jun 30 07:02:10 2026 GMT
   nextUpdate=Jul 30 07:02:10 2026 GMT

   The nextUpdate value is the latest time clients should treat this CRL as fresh. Replace a stale CRL before treating an absent serial as not revoked.

2. Print the target certificate serial and issuer.

   $ openssl x509 -in server.crt -noout -serial -issuer
   serial=1000
   issuer=CN=Example Root CA

   The issuer should match the CRL issuer. The serial number is the value to compare with the revoked certificate entries.

   Related: How to view certificate details using OpenSSL

3. List the CRL entries and compare the target serial.

   $ openssl crl -in ca.crl -noout -text
   Certificate Revocation List (CRL):
           Version 2 (0x1)
           Signature Algorithm: sha256WithRSAEncryption
           Issuer: CN=Example Root CA
           Last Update: Jun 30 07:02:10 2026 GMT
           Next Update: Jul 30 07:02:10 2026 GMT
   ##### snipped #####
   Revoked Certificates:
       Serial Number: 1000
           Revocation Date: Jun 30 07:02:10 2026 GMT
   ##### snipped #####

   A matching serial means the certificate is revoked by this CRL. If No Revoked Certificates. appears or the serial is absent, continue with openssl verify so issuer, CA trust, and CRL application are checked together.

4. Verify the target certificate with the CRL.

   $ openssl verify -CAfile ca.crt -crl_check -CRLfile ca.crl server.crt
   CN=server.example.com
   error 23 at 0 depth lookup: certificate revoked
   error server.crt: verification failed

   -crl_check checks the leaf certificate against the CRL supplied with -CRLfile. Use -crl_check_all only when the CRL set covers every certificate in the chain.

   Related: How to verify a certificate chain using OpenSSL

5. Verify a known non-revoked certificate from the same CA when every certificate appears to fail.

   $ openssl verify -CAfile ca.crt -crl_check -CRLfile ca.crl client.crt
   client.crt: OK

   An OK result confirms the CA certificate and CRL file work together. If every certificate fails, check that ca.crt is the issuing CA and that ca.crl is not expired or from another issuer.