Which item lists certificates that are no longer trusted?

• A. Certificate Revocation List (CRL)
• B. Certificate Authority (CA)
• C. Registration Authority (RA)
• D. Tokenization

Answer: (A)

In PKI, when a certificate should no longer be trusted—whether due to key compromise, loss of the private key, or other revocation reasons—the issuer communicates that status through a revocation mechanism. The Certificate Revocation List is the formal, signed list published by the Certificate Authority that contains the serial numbers of certificates that have been revoked before their expiration. This list is what clients check to determine if a certificate is still trusted; if its serial number is on the CRL, the certificate is considered no longer valid.

A Certificate Authority is the entity that issues and signs certificates, not the list of revoked ones. A Registration Authority helps verify identities on behalf of the CA but doesn’t publish revocation data. Tokenization is a data-security technique unrelated to certificate trust status. Therefore, the item that lists certificates no longer trusted is the Certificate Revocation List.