In a PKI system, what action invalidates a certificate before it expires if it is compromised?

In a PKI system, what action invalidates a certificate before it expires if it is compromised?

• A. Certificate renewal
• B. Certificate revocation
• C. Certificate signing
• D. Certificate expiration

Answer: (B)

When a certificate has to be invalidated before its expiration due to a compromise, the action used is revocation. Revoking a certificate tells anyone who relies on it that it should no longer be trusted, even though the certificate is still technically valid according to its dates. This is managed by the issuing authority (the CA) and made visible to users through mechanisms like a Certification Revocation List (CRL) or Online Certificate Status Protocol (OCSP) responses. The key point is that revocation actively nullifies trust in the certificate as soon as the status is published, which is essential after a private key is compromised. Renewal would simply extend the certificate’s validity, not invalidate it, so it doesn’t address a compromise. Signing refers to issuing or creating a certificate, not invalidating one. Expiration is the natural end of a certificate’s validity, which occurs at a set date, but it doesn’t address an immediate loss of trust due to compromise.

When a certificate has to be invalidated before its expiration due to a compromise, the action used is revocation. Revoking a certificate tells anyone who relies on it that it should no longer be trusted, even though the certificate is still technically valid according to its dates. This is managed by the issuing authority (the CA) and made visible to users through mechanisms like a Certification Revocation List (CRL) or Online Certificate Status Protocol (OCSP) responses. The key point is that revocation actively nullifies trust in the certificate as soon as the status is published, which is essential after a private key is compromised.

Renewal would simply extend the certificate’s validity, not invalidate it, so it doesn’t address a compromise. Signing refers to issuing or creating a certificate, not invalidating one. Expiration is the natural end of a certificate’s validity, which occurs at a set date, but it doesn’t address an immediate loss of trust due to compromise.