Rookie mistake: SSH's KRL is also a CRL. See KEY REVOCATION LISTS in ssh-keygen(1). You can revoke plain keys with it, but also revoke certs (both by serial number and identity) with it.

The infrastructure I built for access control using SSH certs used it. I know it works because I tested for it specifically.

It sounds like you could be making the rookie mistake instead by not reading what he/she actually wrote.

> Yeah the lack of mentioning a CRL at all really stood out when reading this. I actually didn't know about SSH certificates until I saw this article (I always assumed that SSH did not support this), but do run my own CA and authentication for internal web services, EAP-TLS, and VPN. The CRL is your first line of defense in the sense that it blocks the use of that credential instantly when it is revoked.

This sounds like he/she is running an x509 CA. He/she is generating certs for various use-cases.

It is possible to use x509 certs with SSH of course, and so he/she could leverage his/her pre-existing CA for that function.

Given above context CRL is completely accurate. And, KRL is not.

No, SSL CA certificate are in no way like OpenSSL CA issued ones.

The format of the certificate have diverged between two ecospheres about a decade ago.