title: Java + X509: How get Certificates Revoked?
body: <p>Doing debugging in the X509 Certificate Validation Mechanism of Java I just wonder how certificates get revoked? By RFC 4158 (and PKI related documentation) I learned that each CA (or Party providing Trust Anchors) can issue a CRL (Certification Revocation List). </p>
  
  <p>Is Java downloading CRLs on its own or just will provide updated information with each (minor) version I update?</p>
  
  <p>What options exist for a custom infrastructure (is it best practice to provide once own (global) TrustManager?)</p>