What is a CRL distribution point?

A CRL distribution point is a field inside a certificate that says where to fetch the certificate revocation list covering it — usually a plain HTTP URL owned by the issuing CA. A client that wants to know "has this certificate been revoked?" can follow the pointer, download the signed list, and look for the certificate’s serial number.

The extension matters because a CRL is per-issuer, not per-certificate. One list covers everything an intermediate has issued, so the distribution point is how a client maps the certificate in front of it to the right list. The list itself is signed by the CA and carries validity dates of its own, so a client can cache it and knows when to refresh.

CRLs were written off for years as the clunky option — the lists grew to megabytes, and browsers preferred OCSP's per-certificate query. The judgement has since reversed. OCSP's privacy leak (the CA learns which sites each user visits) and its unreliability pushed the ecosystem back toward CRLs, consumed differently than before: browsers now pull full CRLs server-side, compress them into summaries such as Chrome's CRLSets and Firefox's CRLite, and ship those to users with browser updates. Let's Encrypt made the shift concrete by retiring OCSP in 2025 and standing up CRL infrastructure instead, and newer certificate profiles lean on CRL distribution points rather than OCSP URLs.

For an operator there is little to configure: the CA writes the extension, hosts the list, and browsers do their aggregation without you. Where the pointer becomes practically useful is in your own tooling — monitoring that follows the distribution point can tell you your certificate has been revoked, which is exactly the kind of failure that otherwise surfaces as unexplained client errors.