Which practice ensures revocation information is available to relying parties?

• A. Delete expired certificates to save space.
• B. Do nothing until a compromise is detected.
• C. Rely solely on short-lived certificates with no revocation mechanism.
• D. Maintain CRLs or OCSP to convey revocation.

Answer: (D)

Providing revocation information to relying parties hinges on making the current status of certificates accessible whenever necessary. The standard way to do this is by maintaining mechanisms that convey revocation status: Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP). A CA can publish a signed CRL that lists all revoked certificates, and clients download and check a certificate’s serial number against that list. OCSP lets a client ask a real-time responder whether a specific certificate is still valid, returning statuses like good, revoked, or unknown. These approaches ensure that even if a certificate has not expired, its trust can be revoked promptly if compromise or misuse occurs.

The other options fail to provide timely, reliable revocation information. Deleting expired certificates doesn’t communicate revocation status to relying parties. Waiting to act only after a compromise leaves users exposed longer than necessary. Relying solely on short-lived certificates without a revocation mechanism removes a fallback for revocation; even short-lived certificates need a way to convey if they are no longer trustworthy before their natural expiry.