Which artifact is used to revoke certificates and inform entities of invalid certificates?

Which artifact is used to revoke certificates and inform entities of invalid certificates?

• A. The Digital Certificate
• B. The Public Key
• C. The Certificate Authority's Certificate
• D. The Certificate Revocation List (CRL)

Answer: (D)

The concept here is how certificate revocation information is distributed. A Certificate Revocation List is maintained by the issuing authority and contains the serial numbers of certificates that havebeen revoked before their normal expiration. When a system validates a certificate, it checks this list to see if the certificate in use has been revoked. If the serial number appears on the CRL, that certificate is considered invalid and should not be trusted, even if it hasn’t expired yet. A digital certificate itself is the binding of a public key to an identity and includes an expiration date, but it’s not the mechanism for announcing revocation. The CA’s certificate is used to verify the authenticity of certificates (trust in the issuer) rather than to convey revocation status. The Certificate Revocation List is the artifact specifically designed to inform entities about certificates that have been revoked. (Real-time status can also be provided by OCSP, but the standard revocation artifact is the CRL.)

The concept here is how certificate revocation information is distributed. A Certificate Revocation List is maintained by the issuing authority and contains the serial numbers of certificates that havebeen revoked before their normal expiration. When a system validates a certificate, it checks this list to see if the certificate in use has been revoked. If the serial number appears on the CRL, that certificate is considered invalid and should not be trusted, even if it hasn’t expired yet.

A digital certificate itself is the binding of a public key to an identity and includes an expiration date, but it’s not the mechanism for announcing revocation. The CA’s certificate is used to verify the authenticity of certificates (trust in the issuer) rather than to convey revocation status. The Certificate Revocation List is the artifact specifically designed to inform entities about certificates that have been revoked. (Real-time status can also be provided by OCSP, but the standard revocation artifact is the CRL.)