Which item is used to verify the current validity of a certificate in real time without downloading a CRL?

• A. CRL
• B. OCSP
• C. PKI
• D. X.509

Answer: (B)

OCSP, the Online Certificate Status Protocol, is used to verify a certificate’s current validity in real time without downloading a Certificate Revocation List. Instead of fetching a large list of revoked certificates, the client queries a trusted OCSP responder operated by the issuing CA. The responder replies with a status of the specific certificate: good, revoked, or unknown. This gives an up-to-the-moment view of whether the certificate should be trusted, which is especially important during active sessions or when revocation may occur quickly.

In contrast, a CRL is a downloadable list of all revoked certificates. Checking revocation this way means you must fetch and parse potentially large lists and refresh them frequently to stay current, which is slower and less scalable for real-time decisions. PKI is the broader infrastructure that enables certificate issuance and trust, but it isn’t a real-time status-check mechanism by itself. X.509 describes the certificate format but doesn’t provide a live revocation check either. OCSP stapling can optimize the process by having the server supply the OCSP response during the TLS handshake, reducing latency, but the essential concept remains checking status via OCSP.