The private key for a website was stolen, and a new certificate has been issued. Which of the following needs to be updated next?

Question

Options

• ASCEP
• BCRL
• COCSP
• DCSR

• A
  12% (6)
• B
  82% (42)
• C
  4% (2)
• D
  2% (1)

Explanation

When a private key is stolen, the corresponding certificate must be revoked, and the Certificate Revocation List (CRL) must be updated to broadcast that revocation to all relying parties. The CRL is the authoritative list of certificates that should no longer be trusted, so updating it is the immediate next step after issuing the replacement certificate.

Why the distractors are wrong:

• A. SCEP (Simple Certificate Enrollment Protocol) is used to enroll devices and request certificates - it's a delivery mechanism, not a revocation tool.
• C. OCSP (Online Certificate Status Protocol) is a real-time query method for checking revocation status; it reads from the CRL but doesn't need to be "updated" directly - the CRL feeds it.
• D. CSR (Certificate Signing Request) is already done - it's the request submitted before a certificate is issued, not something updated afterward.

Memory tip: Think of the CRL as a "stolen credit card blacklist." When a card (private key) is compromised, you don't change how people apply for cards (CSR/SCEP) - you update the blacklist (CRL) so merchants (servers) know to reject the stolen one.

No community discussion yet for this question.