CAS-001 · Question #277
Which of the following statements are true about OCSP and CRL? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. The CRL is a list of subscribers paired with digital certificate status. B. The main limitation of CRL is the fact that updates must be frequently downloaded to keep the list C. The OCSP checks certificate status in real time. OCSP provides real-time certificate status checking while CRL provides a periodically updated list, and the primary limitation of CRL is the lag between updates that can leave clients with stale revocation data.
Question
Which of the following statements are true about OCSP and CRL? Each correct answer represents a complete solution. Choose all that apply.
Options
- AThe CRL is a list of subscribers paired with digital certificate status.
- BThe main limitation of CRL is the fact that updates must be frequently downloaded to keep the list
- CThe OCSP checks certificate status in real time
- DThe CRL allows the authenticity of a certificate to be immediately verified.
How the community answered
(20 responses)- A95% (19)
- D5% (1)
Why each option
OCSP provides real-time certificate status checking while CRL provides a periodically updated list, and the primary limitation of CRL is the lag between updates that can leave clients with stale revocation data.
The CRL is indeed a list published by the CA that pairs certificate identifiers with their revocation status, making this statement accurate.
CRL's key operational limitation is that clients must periodically download the entire list, creating a window between updates during which a revoked certificate may still be trusted.
OCSP was specifically designed to query a CA's responder in real time for the status of a single certificate, directly addressing the staleness problem inherent in CRL.
CRL does not allow immediate verification - clients must download and check a potentially out-of-date list, which is precisely the limitation OCSP was designed to overcome.
Concept tested: Certificate revocation mechanisms - OCSP vs CRL
Source: https://www.rfc-editor.org/rfc/rfc6960
Topics
Community Discussion
No community discussion yet for this question.