diff --git a/builtin/logical/pki/crl_util.go b/builtin/logical/pki/crl_util.go
index 0744690a8..777fe4479 100644
--- a/builtin/logical/pki/crl_util.go
+++ b/builtin/logical/pki/crl_util.go
@@ -828,13 +828,19 @@ func buildAnyCRLs(sc *storageContext, forceNew bool, isDelta bool) error {
 		}
 	}
 
-	// Next, we load and parse all revoked certificates. We need to assign
-	// these certificates to an issuer. Some certificates will not be
-	// assignable (if they were issued by a since-deleted issuer), so we need
-	// a separate pool for those.
-	unassignedCerts, revokedCertsMap, err := getRevokedCertEntries(sc, issuerIDCertMap, isDelta)
-	if err != nil {
-		return fmt.Errorf("error building CRLs: unable to get revoked certificate entries: %v", err)
+	var unassignedCerts []pkix.RevokedCertificate
+	var revokedCertsMap map[issuerID][]pkix.RevokedCertificate
+
+	// If the CRL is disabled do not bother reading in all the revoked certificates.
+	if !globalCRLConfig.Disable {
+		// Next, we load and parse all revoked certificates. We need to assign
+		// these certificates to an issuer. Some certificates will not be
+		// assignable (if they were issued by a since-deleted issuer), so we need
+		// a separate pool for those.
+		unassignedCerts, revokedCertsMap, err = getRevokedCertEntries(sc, issuerIDCertMap, isDelta)
+		if err != nil {
+			return fmt.Errorf("error building CRLs: unable to get revoked certificate entries: %v", err)
+		}
 	}
 
 	if err := augmentWithRevokedIssuers(issuerIDEntryMap, issuerIDCertMap, revokedCertsMap); err != nil {
diff --git a/changelog/17385.txt b/changelog/17385.txt
new file mode 100644
index 000000000..a6a8749ff
--- /dev/null
+++ b/changelog/17385.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: Do not read revoked certificates from backend when CRL is disabled
+```