Which mechanism allows revoking a certificate before its expiry?

• A. Certificate Signing Request
• B. Public Key Pinning
• C. Digital Signature
• D. Certificate Revocation List (CRL)

Answer: (D)

Revoking a certificate before its expiry is handled by the Certificate Revocation List. The certificate authority maintains this list and adds the serial numbers of certificates that have been revoked—because the private key was compromised, the holder’s permissions changed, or for other policy reasons. When a certificate appears on the CRL, it is considered no longer trustworthy even if its original expiration date hasn’t passed. Clients fetch or access the CRL (often periodically, or via real-time checks like OCSP) to verify that a certificate is still valid. This provides a concrete mechanism to invalidate certificates ahead of time.

The other options don’t manage revocation. A certificate signing request is used to obtain a certificate, not to revoke one. Public key pinning binds a domain to a specific public key to prevent certain attacks, but it doesn’t convey revocation status. A digital signature ensures data integrity and authenticity, not the validity status of a certificate.