It sounds like you could be making the rookie mistake instead by not reading what he/she actually wrote. > Yeah the lack of mentioning a CRL at all really stoo

It sounds like you could be making the rookie mistake instead by not reading what he/she actually wrote. > Yeah the lack of mentioning a CRL at all really stood out when reading this. I actually didn't know about SSH certificates until I saw this article (I always assumed that SSH did not support this), but do run my own CA and authentication for internal web services, EAP-TLS, and VPN. The CRL is your first line of defense in the sense that it blocks the use of that credential instantly when it is revoked. This sounds like he/she is running an x509 CA. He/she is generating certs for various use-cases. It is possible to use x509 certs with SSH of course, and so he/she could leverage his/her pre-existing CA for that function. Given above context CRL is completely accurate. And, KRL is not.