CRLite Puts Every Revoked Certificate Inside Your Browser, No Queries Needed

Certificate revocation — the process of invalidating a digital certificate before it expires — has long relied on flawed mechanisms like CRLs and OCSP, which suffer from staleness, latency, and privacy leaks. CRLite, a system born from 2017 research and later integrated into Firefox, takes a different approach by storing the revocation status of every known certificate directly in the browser. It sources the complete certificate universe from Certificate Transparency logs and pulls revocation data from CAs' own CRLs, then compresses the result using a cascading series of Bloom filters small enough to ship to browsers multiple times a day. This eliminates the need for live queries to certificate authorities, preventing both the privacy exposure of OCSP — which reveals browsing activity to third parties — and the security risk of failing open when a query goes unanswered. The result is a faster, more private, and more reliable revocation check that requires no network round trip at connection time.