Open-The-File.com

Find how to open any file type

.CRL file extension

To open .CRL files on Windows, double-click the .CRL file (or right-click → Open) to start the Certificate Import Wizard and view/install it into the appropriate certificate store.

To open a .CRL file, use a certificate/PKI tool that can read X.509 certificate revocation lists—on Windows you can import/view it via the Certificate Import Wizard, and on macOS/Linux you can inspect it with OpenSSL. Don’t rename the extension; .CRL is a specific PKI data format.

HomeExtension IndexCertificates in indexCertificates category page

Last updated: April 30, 2026 · Reviewed by Julian Stricker

Open on your device

Choose your operating system for a dedicated step-by-step opening guide.

How to open .CRL files

Use these platform-specific instructions to open .CRL files safely.

Windows

  1. Double-click the .CRL file (or right-click → Open) to start the Certificate Import Wizard and view/install it into the appropriate certificate store.
  2. If you only need to inspect contents, use OpenSSL (if installed) to print it, e.g., run: openssl crl -in file.crl -noout -text
Full Windows guide

Mac

  1. If you have OpenSSL available, inspect the CRL in Terminal: openssl crl -in file.crl -noout -text
  2. If the file is DER and OpenSSL reports input format issues, retry by specifying the format (for example: openssl crl -inform DER -in file.crl -noout -text)
Full Mac guide

Linux

  1. Open a terminal and inspect the CRL with OpenSSL: openssl crl -in file.crl -noout -text
  2. If needed, convert between PEM and DER with OpenSSL by specifying -inform/-outform (see the OpenSSL crl documentation)
Full Linux guide

iOS

  1. iOS typically won’t provide a rich CRL viewer; if Files can’t preview it, transfer the .CRL to a desktop system and inspect it with OpenSSL or Windows’ certificate tools.
Full iOS guide

Android

  1. Android commonly lacks built-in CRL inspection tools; if it won’t open, move the file to a desktop and view it with OpenSSL or Windows’ certificate tools.
Full Android guide

Security notes

  • A CRL is signed PKI data; treat it as untrusted input until parsed by reputable tooling—malformed ASN.1/DER data can trigger vulnerabilities in buggy parsers.
  • A CRL can be used to influence certificate validation outcomes; only use CRLs obtained from the CA’s official distribution points or trusted administrative channels.
  • Prefer verifying CRL details (issuer, thisUpdate/nextUpdate, and scope) before relying on it for operational decisions, especially in enterprise environments.

Recommended antivirus software

Scan files before opening them. These antivirus tools help protect against malware and viruses.

Avast

Avast offers free and premium antivirus software that protects against viruses, malware, ransomware, and phishing. Scan files before opening them to ensure safety.

Norton

Norton 360 delivers comprehensive antivirus protection, VPN, and identity theft monitoring. Scan files for threats before opening to keep your device secure.

We may earn a commission when you use affiliate links. This supports our free file extension guides.

Can't open this file?

These are the most common causes and fixes when .CRL files fail to open.

Common reasons

  • OpenSSL says it cannot read the CRL (PEM/DER mismatch)
  • Windows import/view fails or shows unexpected results
  • The CRL appears “expired” or not yet valid

Fix steps

  1. Try OpenSSL with an explicit input format: openssl crl -inform DER -in file.crl -noout -text
  2. If it’s PEM, ensure the file contains a PEM header/footer (often begins with '-----BEGIN X509 CRL-----') and rerun without -inform DER

OS-specific troubleshooting

What is a .CRL file?

A .CRL file contains an X.509 v2 Certificate Revocation List, which is signed by a Certificate Authority and lists revoked certificate serial numbers plus metadata (such as issue time and next update). CRLs are commonly encoded as DER (binary) or PEM (Base64) and are defined in RFC 5280. The registered Internet media type is application/pkix-crl and the file extension is .crl.

Background

CRL files are a core part of public key infrastructure (PKI): when a certificate must be invalidated before its natural expiration (for example, key compromise or decommissioning), the issuing CA can publish that certificate’s serial number in a CRL. Systems that validate certificates may download CRLs (often from a CRL Distribution Point URL embedded in certificates) to check revocation status.

Common MIME types: application/pkix-crl

Further reading

Authoritative resources for more details on the .CRL format.

Common .CRL issues

OpenSSL says it cannot read the CRL (PEM/DER mismatch)

CRLs are commonly stored as either DER (binary) or PEM (Base64). If the tool assumes the wrong encoding, it may fail to parse the file.

  1. Try OpenSSL with an explicit input format: openssl crl -inform DER -in file.crl -noout -text
  2. If it’s PEM, ensure the file contains a PEM header/footer (often begins with '-----BEGIN X509 CRL-----') and rerun without -inform DER

Windows import/view fails or shows unexpected results

The CRL may be corrupted/incomplete, or you may be importing it into the wrong store/context (for example, expecting it to apply to a different CA).

  1. Re-download the .crl from its official distribution source (for example, the CA’s published CRL URL) and try again.
  2. Confirm the CRL issuer matches the CA you expect by inspecting it (e.g., with OpenSSL text output) before importing.

The CRL appears “expired” or not yet valid

CRLs include update timing fields; if the system clock is wrong, or the CRL is older than expected, validation tooling may treat it as stale.

  1. Check your device date/time settings and correct them if necessary.
  2. Obtain the latest base/delta CRL from the official CA distribution location and re-check.

FAQ

What does a .CRL file do?

It lists revoked certificate serial numbers (and related metadata) for a given Certificate Authority, allowing systems to check whether a certificate has been revoked before trusting it.

Is .CRL the same as a certificate (.CER/.CRT)?

No. A certificate identifies a public key and subject; a CRL is a signed list of certificates that have been revoked by a CA.

How can I tell if my .CRL is DER or PEM?

PEM is text and often contains '-----BEGIN X509 CRL-----'. DER is binary and will look like random bytes in a text editor; OpenSSL can parse either if you specify the correct input format.

What is the official MIME type for .CRL files?

The registered media type is application/pkix-crl (IANA).

Similar file extensions

Compare related formats in the same category to find the right tool faster.