A company wants to ensure that the validity of publicly trusted certificates used by its web server can be determined even during an extended internet outage. Which of the following should be…

A recovery agent is used to recover encrypted data by decrypting it with a specific key, not for checking the validity or revocation status of a certificate.

OCSP (Online Certificate Status Protocol), especially through OCSP stapling, enables a web server to periodically fetch and cache a signed revocation status from the certificate authority. During a TLS handshake, the server 'staples' this response to its certificate, allowing clients to verify revocation status without needing to contact the OCSP responder themselves, thus supporting validity checks even during client or server internet outages to the responder.

While Certificate Revocation Lists (CRLs) provide revocation status and can be cached, during an extended internet outage, a cached CRL might become outdated, preventing clients from determining the most current revocation status accurately.

Key escrow involves storing copies of private keys for disaster recovery or legal access purposes, which is unrelated to determining the validity of publicly trusted certificates.