Which artifact is used to track revoked certificates by a CA?

Which artifact is used to track revoked certificates by a CA?

• A. Certificate Archive List
• B. Certificate Revocation List
• C. Certificate Validation List
• D. Certificate Renewal List

Answer: (B)

When checking if a certificate is still trusted, the CA publishes a Certificate Revocation List. This artifact explicitly records certificates that have been revoked before their scheduled expiration, listing each certificate by its serial number along with the revocation date. Clients fetch and consult the CRL (often via a CRL Distribution Point embedded in the certificate) to determine whether the presented certificate appears on the revoked list. The CRL is periodically updated by the CA and signed to ensure trust. The other options don’t fit standard PKI practice. An Archive List is not a recognized mechanism for revocation—archiving issued certificates is a separate concern. A Validation List and a Renewal List aren’t standard artifacts used to track revocations in PKI.

When checking if a certificate is still trusted, the CA publishes a Certificate Revocation List. This artifact explicitly records certificates that have been revoked before their scheduled expiration, listing each certificate by its serial number along with the revocation date. Clients fetch and consult the CRL (often via a CRL Distribution Point embedded in the certificate) to determine whether the presented certificate appears on the revoked list. The CRL is periodically updated by the CA and signed to ensure trust.

The other options don’t fit standard PKI practice. An Archive List is not a recognized mechanism for revocation—archiving issued certificates is a separate concern. A Validation List and a Renewal List aren’t standard artifacts used to track revocations in PKI.