What is the purpose of a Certificate Revocation List (CRL)?

• A. To publish new certificates
• B. To bind a public key to an identity
• C. To revoke certificates that should no longer be trusted
• D. To renew expired certificates

Answer: (C)

A Certificate Revocation List is used to explicitly mark certificates as no longer trustworthy before their planned expiration. It’s published by the certificate authority and contains the serial numbers of certificates that have been revoked, for reasons such as key compromise, change of affiliation, or policy violations. When validating a certificate, clients (like browsers or servers) can check the CRL to see if the certificate in question appears on the list; if it does, it must be rejected even if the certificate hasn’t expired yet. This protects security by ensuring that compromised or misissued certificates aren’t trusted.

Publishing new certificates is what happens when a CA issues a fresh certificate, not when revoking one. Binding a public key to an identity is the purpose of the certificate itself, which occurs during issuance. Renewing expired certificates is a separate process involving reissuing or extending validity, not revocation.