A “hot lists” that identifies certificates that have been withdrawn, canceled or compromised or that should not be trusted because of other identified reasons. CRLs should be replicated to all subscribing servers to a specific root certification authority.