Which protocol provides real-time verification of certificate revocation status for client certificates?

• A. OCSP
• B. CRL
• C. S/MIME
• D. TLS

Answer: (A)

Real-time verification of a certificate’s revocation status is provided by OCSP. It lets a certificate consumer query the issuing authority’s OCSP responder to check the current status of a specific certificate at the moment it’s presented. The responder returns whether the certificate is still good, has been revoked, or if the status is unknown. This on-demand check is why OCSP is preferred for real-time revocation status.

A certificate revocation list is a static snapshot that must be downloaded and can become outdated between updates, so it doesn’t offer the same real-time assurance. S/MIME is a secure email standard, and TLS is the transport security protocol that uses certificates but does not itself provide revocation checking. OCSP (and OCSP stapling, which helps deliver the OCSP response during the TLS handshake) gives the real-time status needed when validating client certificates.