What is the purpose of a certificate revocation list (CRL) in PKI?

• A. To list revoked certificates and prevent trust to those keys.
• B. To store user credentials.
• C. To generate new certificates.
• D. To replace keys.

Answer: (A)

In PKI, the purpose of a certificate revocation list is to publish certificates that have been revoked so that relying parties stop trusting those certificates and the keys they bind. The CA signs and distributes the list, which contains the serial numbers of revoked certificates and the revocation times. When a certificate is presented, systems can check the CRL to see if its serial number is on the list; if it is, the certificate is considered untrustworthy even if it hasn’t expired. This mechanism helps prevent misuse if a private key is compromised, information changes, or policy violations occur. The CRL isn’t used to store user credentials, it isn’t for generating new certificates, and it doesn’t replace keys. It’s a revocation check, with real-time alternatives like OCSP available for quicker status verification.