● Covered by 1 source · 1 reportHigh impact
Firefox Implements CRLite for Secure Certificate Revocation Checking
Key points
- Introduces CRLite for revocation checking in Firefox 137.
- Downloads and stores a compact list of revoked certificates locally.
- Enhances privacy by eliminating OCSP requests that reveal browsing intent.
Introduction of CRLite in Firefox
Firefox now employs CRLite, a new method for certificate revocation checking. This implementation is unique as it does not disclose users' browsing activities, even to Mozilla, setting it apart from other browsers.
The launch of CRLite in Firefox 137 aims to improve security and privacy regarding TLS server certificates.
How CRLite Works
CRLite operates by periodically downloading a compact encoding of all revoked certificates from Certificate Transparency logs. This encoding is stored locally and updated every 12 hours, allowing Firefox to privately check for revocations as new TLS connections are established.
Previously, Firefox relied on the Online Certificate Status Protocol (OCSP), which posed privacy risks by leaking user browsing intentions.
Impact on Certificate Revocation
Revocation checking traditionally faced challenges due to the need for real-time queries or maintaining updated lists of revoked certificates. With CRLite, these challenges are addressed, making revocation checking reliable and efficient for users.
The new approach allows users to verify server authenticity without exposing their activity to third-party servers.
Context Around Certificate Revocation
Certificate revocation is crucial as revoked certificates can lead to severe security vulnerabilities. The traditional OCSP method is increasingly becoming less reliable, as major certificate authorities move away from it due to privacy concerns.
CRLite represents a significant advancement in online security by addressing both privacy and performance in revocation checking.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cabforum/servercert GitHub mozilla/clubcard GitHub mozilla/clubcard-crlite GitHub mozilla/crliteReporting from
Firefox has introduced CRLite, allowing private and efficient certificate revocation checking, marking it the first browser to do so. This change enhances security by ensuring that revoked certificates, which pose security risks, are identified accurately without revealing user browsing activity.