How do I obtain a certificate with CRL extension?

Since 2019, our SSL certificates have been issued without a CRL extension. Instead, OCSP (=Online Certificate Status Protocol) is used to check the status of a certificate. You can find out exactly what CRL and OCSP are and how you can still obtain a certificate with a CRL extension below.

What is CRL?

CRL (=Certificate Revocation List) is a list of SSL/TLS certificate serial numbers that have been revoked or suspended before they expire and should no longer be considered trustworthy by browsers. There can be various reasons why a certificate should no longer be classified as trustworthy:

• the PrivateKey has been stolen or otherwise compromised
• the certification authority (CA) distrusts the requester
• the certificate was issued incorrectly

When a browser sends a request to a secure website, the responsible certification authority receives the request and sends a response back to the browser with a list of all revoked certificates. The browser then uses the serial number to check whether the certificate for the requested website is available in the CRL. The CRL extents in an SSL certificate tell the browser which certification authority is responsible for the request.

The problem is that CRLs are very error-prone, as these lists have to be updated regularly. This creates a high maintenance effort for the certification authorities and creates a time window in which a revoked SSL/TLS certificate is still displayed as trustworthy. CRLs are also inefficient, as they can only be checked very slowly depending on the length of the list. CRL has now been replaced by OCSP.

What is OCSP?

Like CRL, the protocol is used to check the trustworthiness of an SSL/TLS certificate. The original OCSP had considerable problems, which is why the new "OCSP Stapling" approach has become established and is used by certification authorities and browsers to check SSL/TLS certificates. 

To check the certificates, the certification authorities provide special servers, so-called OCSP responders, which wait for OCSP requests. However, instead of sending a request to the server for each certificate verification request, "OCSP Stapling" enables the web server to contact the OCSP responder directly at regular intervals and cache its response. Depending on the OCSP response, either the website is then displayed in the browser or an error message appears stating that the website's certificate is invalid. An OCSP responder issues the following responses:

• good: The certificate is not revoked.
• revoked: The certificate is invalid or has been revoked.
• unknown: The status of the certificate is unknown to the issuer.

The great advantage of OCSP stapling is that an SSL/TLS certificate can be checked in real time, which significantly reduces the loading time of a website. Furthermore, no user browser information is sent to the certification authority, as the verification is carried out by the web server.

How can I obtain my certificate with CRL extension?

OCSP stapling is supported by all major browsers and certification authorities, but you may still need to use the CRL extension, especially with older software. In this case, the certificate must be subsequently adapted. 

To obtain your certificate with CRL extension, proceed as follows:

Alternative option

Alternatively, you can also obtain the lists manually. To do this, you can request the information from the following server:

• OCSP: ocsp.usertrust.com TCP/80
• CRL: crl.usertrust.com TCP/80