Which PKI component is used to revoke certificates before expiration?

• A. Certificate Authority
• B. Registration Authority
• C. Certificate Revocation Lists
• D. Public key certificate

Answer: (C)

Certificate revocation information is kept in a signed, periodically published list that tells systems which certificates should no longer be trusted before their expiration. This list is the Certificate Revocation List. The Certificate Authority signs and publishes the CRL, which contains the serial numbers of certificates that have been revoked—perhaps because a private key was compromised or the user left the organization. Clients fetch the latest CRL and check the certificate they’re presented against the list; if the serial number appears, the certificate is rejected even if its valid-from/valid-to dates haven’t passed. This mechanism is what allows authorities to revoke trust on a certificate before its normal expiration.

The other options describe parts of PKI that don’t perform revocation themselves: the Certificate Authority issues and signs certificates; the Registration Authority assists with enrollment and verification; a public key certificate is the actual credential issued to an entity. In practice, some systems also use OCSP for real-time revocation checks, but CRLs are the established method referenced here.