Why do Certificate Revocation Lists become a problem in an organisation with high staff turnover?

Every revocation makes the list longer, so clients download and search an ever-growing file, and between publications they work with stale data.

A CRL lists every revoked certificate that has not yet expired. With many people leaving, many certificates are revoked, and each stays on the list until its own expiry date. Consequences:

• Size and bandwidth. Every verifier downloads the whole list, for one certificate check, and again after every update. Large public CAs have had CRLs of many megabytes.
• Lookup cost. The verifier has to go through the list for each certificate it checks.
• Staleness. A CRL is published at intervals (hours to a week) and cached by clients until its next update time. A certificate revoked just after a publication still looks valid until the next one: the window an ex-employee can exploit.
• Load on the CA. Publishing more often narrows that window but multiplies downloads.

Mitigations: delta CRLs (only changes since the last full CRL), short certificate lifetimes, and above all OCSP, which answers about one certificate instead of shipping the whole list.

Go deeper:

• Wikipedia: Certificate revocation list — the problems with CRLs, including size and latency.