Which statement best describes the purpose of a CRL in security operations?

Which statement best describes the purpose of a CRL in security operations?

• A. To list certificates that have been revoked
• B. To issue new certificates
• C. To sign certificates for trust
• D. To store private keys

Answer: (A)

A CRL (Certificate Revocation List) is the mechanism that publicly lists certificates that have been revoked before their expiration. It is published by the certificate authority and contains entries keyed by each certificate’s serial number, along with the revocation date and often the reason. When systems validate a certificate, they consult the CRL to determine if the certificate’s serial number appears on the list; if it does, the certificate is no longer trusted even if it hasn’t expired. This helps quickly revoke trust for compromised keys, misissued certificates, or changes in an entity’s status. CRLs are distributed at known locations and updated on a schedule, which can introduce a lag between revocation and recognition; for more immediate status checks, protocols like OCSP are used. Issuing new certificates, signing certificates to establish trust, and storing private keys are separate PKI functions and not the purpose of a CRL.

A CRL (Certificate Revocation List) is the mechanism that publicly lists certificates that have been revoked before their expiration. It is published by the certificate authority and contains entries keyed by each certificate’s serial number, along with the revocation date and often the reason. When systems validate a certificate, they consult the CRL to determine if the certificate’s serial number appears on the list; if it does, the certificate is no longer trusted even if it hasn’t expired. This helps quickly revoke trust for compromised keys, misissued certificates, or changes in an entity’s status. CRLs are distributed at known locations and updated on a schedule, which can introduce a lag between revocation and recognition; for more immediate status checks, protocols like OCSP are used. Issuing new certificates, signing certificates to establish trust, and storing private keys are separate PKI functions and not the purpose of a CRL.