A browser must check whether a server certificate has been revoked at the moment of connection, without downloading the certificate authority's entire list of revoked serial numbers. Which mechanism should it use?
Select an answer to reveal the explanation.
Short Explanation
A CRL is like printing out the whole "do not admit" list and reading through it at the door. OCSP is just calling the front desk and asking about one name. When you need a quick answer on a single certificate, you make the call.
Full Explanation
The Online Certificate Status Protocol lets a client ask an OCSP responder, operated by or for the certificate authority, about the status of one specific certificate. The responder returns a signed answer of good, revoked, or unknown, so the client receives current information without retrieving the full revocation list. OCSP stapling extends this by having the server attach a recent signed response during the TLS handshake, reducing latency and privacy concerns. A certificate revocation list is a signed file listing all revoked serial numbers for a CA; it works but requires downloading and searching the entire list, and it is only as current as its last publication, which conflicts with both requirements in the stem. A certificate signing request is generated by a subject that wants a certificate issued; it is unrelated to checking the status of an existing certificate. A wildcard certificate covers multiple subdomains under one name pattern; it has no role in revocation checking, and revoked certificates are never automatically covered by anything. Exam caveat: CRL equals a downloaded list, OCSP equals a real-time query about one certificate, and stapling equals the server delivering that response. Operational check: confirm that issued certificates include an OCSP responder address, verify the responder is reachable from client networks, and enable OCSP stapling on public web servers.