IPA IP 2025 Question 87
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問87, translated into English. ITPEC is based on the same exams.
In PKI, there is a CRL as a list in which the information on digital certificates that meet a certain condition is published. Which of the following is the appropriate condition for being listed in this list?
Explanation
Revoked within the validity period — a CRL (certificate revocation list) lists certificates that were invalidated before they expired.
A certification authority revokes a certificate before its expiry when, for example, the private key has leaked, the holder's details have changed, or the holder no longer uses it. The CA publishes the serial numbers of such certificates with the revocation date in the CRL, signed by the CA. A party that receives a certificate checks the CRL (or asks an OCSP responder) to make sure the certificate, though still within its period, has not been revoked.
Answer (c)
Why not others:
- •(a) — an expired certificate is invalid simply by its date, which anyone can read from the certificate; it does not need to be listed
- •(b) — certificates always carry a finite validity period; there is no unlimited certificate to list
- •(d) — a certificate's validity period is not extended; a new certificate is issued instead, and renewal is not a reason to list it
Key rule: CRL = certificates revoked before their expiry date (such as after a key leak); check it, or OCSP, before trusting a certificate.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.