What is used by PKI entities to verify the validity of a digital certificate?

What is used by PKI entities to verify the validity of a digital certificate?

• A. The Certificate Revocation List (CRL) contains a list of revoked certificate serial numbers that have been invalidated because they have expired. The CRL can be polled by PKI entities to determine the validity of the digital certificate in question.
• B. The Digital Certificate
• C. The Public Key
• D. The Certificate Authority's Private Key

Answer: (A)

Verifying a certificate’s trust status involves checking its revocation status along with its expiration. The Certificate Revocation List is exactly what PKI entities consult to see if a certificate has been revoked by the issuing CA. The CRL contains the serial numbers of certificates that are no longer trusted, so if the certificate’s serial number appears on the list, it should not be trusted even if its signature is valid and the current date is within the certificate’s validity period. This is why the CRL is the mechanism used to determine validity in terms of revocation. The digital certificate itself is what’s being validated, not a mechanism to verify its status. The public key is part of the certificate and is used to verify signatures, not to check revocation. The CA’s private key is used to sign certificates, not to verify their current validity.

Verifying a certificate’s trust status involves checking its revocation status along with its expiration. The Certificate Revocation List is exactly what PKI entities consult to see if a certificate has been revoked by the issuing CA. The CRL contains the serial numbers of certificates that are no longer trusted, so if the certificate’s serial number appears on the list, it should not be trusted even if its signature is valid and the current date is within the certificate’s validity period. This is why the CRL is the mechanism used to determine validity in terms of revocation.

The digital certificate itself is what’s being validated, not a mechanism to verify its status. The public key is part of the certificate and is used to verify signatures, not to check revocation. The CA’s private key is used to sign certificates, not to verify their current validity.