What is the purpose of certificate revocation mechanisms such as CRL or OCSP?

• A. Issue new certificates
• B. Verify identities via RA
• C. Revoke compromised certificates
• D. Store private keys securely

Answer: (C)

Certificate revocation mechanisms exist to invalidate certificates that should no longer be trusted. If a private key is compromised, if the certificate was issued in error, or if policy indicates it should no longer be valid, revocation stops the certificate from being trusted even before its scheduled expiry.

A certificate revocation list (CRL) is a published, periodically updated list of certificates that have been revoked by the issuing authority. Online Certificate Status Protocol (OCSP) provides real-time status about a specific certificate, letting applications check quickly whether that particular certificate is still valid. Together, these mechanisms ensure that relying parties can avoid trusting certificates that are no longer trustworthy.

These functions aren’t about issuing new certificates, which is the role of the issuing authority; nor about verifying identities via a registration authority, which is part of the enrollment/issuance process; nor about storing private keys securely, which is a separate aspect of key management. The core purpose here is to invalidate and communicate the invalidation of certificates when trust should be withdrawn.