CRLite Extension

Checks if a certificate is revoked using Bloom filter cascade.

CRLite – Safer browsing through certificate checks CRLite helps you avoid risky sites by checking whether a page’s TLS/SSL certificate is expired, revoked, or untrusted. When a problem is detected, the extension blocks the page and shows a clear explanation. When everything looks good, you won’t notice a thing. What CRLite does: Blocks unsafe pages: Stops navigation to sites with: Expired certificates Revoked certificates (via OCSP, enabled by default) Untrusted certificate chains (basic trust check) Explains why: Shows a friendly block page with the domain and reason. Status at a glance: The popup displays the last-checked domain, status badge, and certificate details (Subject, Issuer, Serial, Valid From/To). How it works (high level) On page load, CRLite checks the current domain’s certificate via a lightweight validation service. The service inspects the live TLS certificate and returns: Expiry information OCSP revocation status (good/revoked/unknown) A basic platform trust verdict The extension uses this result to allow or block the page and updates the popup. Why it’s useful Avoids phishing/MITM risks: Blocks common certificate-based attacks and misconfigurations. Clear and minimal: No noisy warnings, only actionable decisions with a simple explanation. Configurable: Use the built-in validation service or point to your own; toggle revocation checks on/off. What you’ll see Normal browsing: No changes when certificates are valid and trusted. Unsafe page: A CRLite block page replaces it, showing the affected domain and reason. Popup: Status badge of the last site checked, with key certificate fields for transparency. Permissions (plain English) tabs: Needed to read the current tab’s URL to check its domain. storage: Saves your preferences and the last check result. Host access (your validation service): Only used to request certificate status for the current domain. Privacy No personal data collected. Only the current tab’s domain is sent to the validation service you configure. You can self-host the validation service and point CRLite to it in Options. Configuration Open the extension’s Options: API Base URL: Use the default service or your own. Block revoked certificates (OCSP): ON by default; turn OFF if you only want expiry blocking. Changes take effect immediately after saving (refresh the page to re-check). Troubleshooting Status shows “Unknown”: Ensure your API URL is reachable and saved in Options; reload the extension and the page. A “revoked” demo shows as not revoked: Some demos test root/intermediate distrust, not leaf revocation. CRLite also performs a basic chain trust check, but OCSP availability can vary by CA. Enterprise networks: Firewalls may block OCSP/AIA requests; try again on a different network. Compatibility Built for Chrome Manifest V3. Works alongside other privacy/security tools. Support and self-hosting You can self-host the validation service on any Node.js platform and simply update the API URL in Options. Issues or ideas? Contact the developer or open an issue on the project repository.