A city CA issued a certificate that was later revoked after a private-key compromise. What should relying parties do before trusting that certificate?
Select an answer to reveal the explanation.
Short Explanation
Issuance is not a lifetime hall pass. After a CA says 'revoked,' clients need a fresh status check—CRL or OCSP—before they keep trusting that badge. Matching the name alone is not enough once the key is burned.
Full Explanation
Public-key infrastructures rely on revocation checking so certificates compromised or otherwise invalidated are not trusted until expiry. Certificate Revocation Lists and Online Certificate Status Protocol are standard ways clients learn current status. Trust-on-first-verify-forever, name matching without revocation checks, or converting to self-signed certificates undermine PKI trust decisions.