Java Security

Hi Friends..

Now, i'm learning about the CRL and OCSP..
but now, i want to get the right concept of CRL in advance..
Can we add Client's certificate Serial Number into existing CRL dynamically?..
if it can't achieved, so it means that we have to "always" create new CRL?..
And we have to "manage" old revocation list data in somewhere, let's say we store it in XML, or database

Please correct me if i'm wrong..

Thanks,

Leonardo C.