OneCRL

Every encrypted website has a digital certificate — a kind of electronic ID that confirms: this site really is what it claims to be. Such certificates are issued by organizations called certificate authorities. Sometimes, however, a certificate must be declared invalid before its actual expiration date — for example, because a company was hacked or because the certificate authority made a mistake. This is exactly what OneCRL exists for: a centrally maintained list of revoked certificates that Mozilla feeds directly into the Firefox browser. When someone visits a website, Firefox first checks this list and blocks the connection immediately if the certificate is on it.

The problem with revoked certificates

Without such a list, the browser would have to rely on other methods. The older standard approach is called OCSP (Online Certificate Status Protocol): the browser asks an external server whether a certificate is still valid — for every single page visit. This costs time and doesn’t work at all if the query server is unreachable. Many browsers then silently ignored the error and allowed the connection anyway. In practice, a revoked certificate often remained effective.

OneCRL solves this problem by cutting out the detour through external servers. Mozilla centrally collects the most important revocation notices, verifies them, and transmits the updated list directly to Firefox. The browser then decides locally, without making an external request. This is faster, more reliable, and also works offline. Security researchers therefore speak of significantly stronger protection compared to the old OCSP method.

Structure and updating of the revocation list

OneCRL focuses on so-called intermediate certificates. These are certificates that do not themselves identify websites, but instead serve as a middle tier between a large root certificate authority and the individual website certificates. If such an intermediate certificate is compromised, potentially thousands of websites are affected. This is precisely why it is worthwhile to monitor this class of certificates centrally.

The list itself is distributed via Mozilla’s Remote Settings infrastructure — a system that updates Firefox regularly in the background without requiring any action from the user. If a certificate authority reports a revoked certificate or Mozilla’s own security team discovers a problem, the entry ends up in the list within a few hours. In the past, it used to take days before a browser actually stopped accepting a revoked certificate.

OneCRL is not a replacement for all revocation mechanisms. For ordinary website certificates, Firefox additionally uses other methods, including CRLite — a newer, storage-efficient format that makes even more certificates locally verifiable. OneCRL and CRLite work alongside each other, together covering a larger scope.

OneCRL in practice and in the news

OneCRL became known, among other things, in 2015, when Mozilla introduced it as a direct response to several incidents in which certificate authorities had issued faulty or abused certificates. Since then, the term has regularly appeared in security reports — whenever a certificate authority comes under criticism and Mozilla has to react quickly.

For users, OneCRL remains invisible. There is no setting, no button, no notice in the browser. Anyone who still wants to take a look can find the current list publicly available on Mozilla’s website — every entry with date, reason, and the affected certificate authority. This degree of transparency is itself a security feature: researchers and journalists can trace which authorities Mozilla no longer trusts.

In the bigger picture, OneCRL represents a shift in browser security: away from sluggish, error-prone real-time queries, toward locally stored, regularly updated lists. This approach also influenced other vendors. Google's Chrome browser pursues a similar principle with CRLSets, which likewise relies on a centrally maintained revocation list.