What is a Certificate Revocation List (CRL)?

Question

Options

• AA list of X.509 certificates that have been issued by a particular CA
• BA list of X.509 certificates that have been revoked by a particular CA
• CA list of public keys that have been compromised
• DA list of private keys that have been compromised

• A
  2% (1)
• B
  91% (49)
• C
  6% (3)
• D
  2% (1)

Explanation

A CRL is a digitally signed document published by a Certificate Authority (CA) that lists the serial numbers of X.509 certificates it has revoked before their expiration date - making B correct. Option A describes a certificate issuance record (closer to a certificate registry or log), not revocation. Options C and D are wrong because CRLs track certificates (which bind identities to public keys), not raw keys themselves - and private keys are never published in PKI infrastructure at all.

Memory tip: Think of a CRL like a hotel's "do not honor" list - the CA (hotel) issued the keycards (certificates), but some were reported lost or stolen, so it maintains a list of cards to reject, not a list of all cards ever made.

No community discussion yet for this question.