What is a CRL?

• A. A list of revoked certificates
• B. A real-time certificate validation protocol
• C. A method to create new certificates
• D. A protocol for key exchange

Answer: (A)

A CRL is a list of certificates that have been revoked by a certificate authority. When a certificate is found to be compromised or no longer trustworthy, the CA adds its serial number to the CRL and publishes it. Systems that validate certificates can check this list to ensure the certificate in use hasn’t been revoked; if it’s on the list, the certificate should be treated as invalid even if it hasn’t expired yet.

CRLs are not used for real-time validation—that role is filled by the Online Certificate Status Protocol (OCSP), which provides individual status checks rather than a bulk list. A CRL also isn’t how new certificates are created; issuance is handled separately by the CA. And it isn’t a protocol for exchanging cryptographic keys—key exchange protocols are things like TLS handshakes.