A certificate extension that tells relying parties where to download the issuing CA's certificate revocation list, usually as one or more HTTP or LDAP URLs. If every CDP URL is unreachable, strict validators treat revocation status as unknown and may reject the certificate. CDP URLs must therefore be reachable from wherever the certificate will be validated, including from the internet for cloud scenarios.