A security administrator must implement a system to ensure that invalid certificates are not used by a custom developed application. The system must be able to check the validity of certificates…

A Certificate Signing Request (CSR) is used to request a new certificate from a CA, not to check the validity or revocation status of an existing certificate, especially not offline.

The Online Certificate Status Protocol (OCSP) is an online protocol that queries an OCSP responder in real-time to check certificate revocation status, making it unsuitable when internet access is unavailable.

A Certificate Revocation List (CRL) is a list of revoked certificates published by a Certificate Authority (CA) that can be downloaded and cached by clients. This allows the custom application to check the revocation status of a certificate against a locally stored copy of the CRL, fulfilling the requirement for offline validity checking.

Secure Shell (SSH) is a network protocol for secure remote access and data transfer, not a mechanism for applications to check the revocation status of digital certificates.