Which protocol enables clients to query the revocation status of a certificate in real time?

Which protocol enables clients to query the revocation status of a certificate in real time?

• A. CRL
• B. Entropy
• C. Online Certificate Status Protocol (OCSP)
• D. Certificate Signing Request (CSR)

Answer: (C)

Real-time certificate revocation checking is achieved with a protocol that lets a client ask a responder about the status of a specific certificate. This protocol is designed to answer immediately: is this certificate still valid, has it been revoked, or is the status unknown? The responder returns a clear status result, often with a timestamp, which the client can use to continue the secure connection decision. This approach is preferable to using large revocation lists, because those lists can be big and may not reflect the most current status if not updated frequently. The responder-based method provides up-to-date information during, for example, a TLS handshake, enabling real-time validation of the certificate. The other options don’t fit this purpose: one is just a mechanism for distributing revocation lists, not querying status in real time; another is used to request a certificate in the first place and has nothing to do with revocation checks.

Real-time certificate revocation checking is achieved with a protocol that lets a client ask a responder about the status of a specific certificate. This protocol is designed to answer immediately: is this certificate still valid, has it been revoked, or is the status unknown? The responder returns a clear status result, often with a timestamp, which the client can use to continue the secure connection decision.

This approach is preferable to using large revocation lists, because those lists can be big and may not reflect the most current status if not updated frequently. The responder-based method provides up-to-date information during, for example, a TLS handshake, enabling real-time validation of the certificate.

The other options don’t fit this purpose: one is just a mechanism for distributing revocation lists, not querying status in real time; another is used to request a certificate in the first place and has nothing to do with revocation checks.