Your files stay on your device

# CRL distribution point checker

Extracts the CRL distribution points from a pasted PEM certificate, fetches each endpoint with a direct GET and the proxy as fallback, and reports whether the answer is a DER-encoded CRL, sniffed from the leading SEQUENCE bytes.
Certificate in PEM form

What this tool does not do: it never decides whether a serial number is revoked. That question needs the signed CRL downloaded, parsed, and checked against the issuer, and a half-done version of it produces confident wrong answers, so the check stops at endpoint liveness and the DER header. A certificate with no CRL distribution points is normal for short-lived certificates (Let's Encrypt issues 90-day certs with no CDP), and browsers mostly ignore CRLs anyway; many non-browser clients hard-fail when the endpoints are down. For the definitive answer, run the commands below against the real certificate and CRL.

The definitive revocation check, with your files

openssl x509 -in cert.pem -noout -text | grep -A4 "CRL Distribution Points"

curl -o crl.pem http://crl.example.com/intermediate.crl

openssl crl -in crl.pem -noout -text
Options

## More web & auth tools

- [Certificate & CSR](/web/certificate)
- [HTTP header parser](/web/headers)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/crl-distribution-point-checker
Markdown version: https://nutter.tools/web/crl-distribution-point-checker.md
Plain-text version: https://nutter.tools/web/crl-distribution-point-checker.txt
Agent index: https://nutter.tools/llms.txt