Purpose of CA in a PKI: Issue and Revoke Certificates
Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography
What is the purpose of CA in a PKI?
Answer
Correct answer: B — to issue and revoke digital certificates
Community Insight
The exam tests the specific operational duties of a CA versus the cryptographic verification process; the common trap is confusing the issuer's action with the verifier's action.
This question clarifies the primary function of a Certificate Authority (CA) within Public Key Infrastructure, distinguishing its role in issuing and revoking certificates from the validation performed by relying parties.
Many learners select Option A because they associate CAs with 'trust' and 'validation,' failing to realize that validation is technically performed by the client or server (relying party) checking the signature, not the CA itself during the handshake.
Community Discussion (18 comments)
XBfoundX
👍 1
Selected: B
A is not correct the relying party (e.g., the web browser, client, or server) validates the authenticity of a certificate during a TLS handshake by checking the CA’s signature against its trusted root store. The CA issues the certificate, but the client does the validation.
Girmiti
👍 2
Selected: B
B is the correct answer. https://community.cisco.com/t5/security-knowledge-base/ca/ta-p/3114159#:~:text=As%20part%20of%20a%20public%20key%20infrastructure%20%28PKI%29%2C,information%2C%20the%20CA%20can%20then%20issue%20a%20certificate.
ton99
👍 1
The answer is B: "Vetting (verifying) the identity of the website owner or organization: When you request a certificate from CA, it verifies the information you provide. This information includes the organization’s name, domain name, address, email address and a public key.....If the certification authority realizes it has improperly issued a certificate, it revokes the certificate and issues a new one for the same entity. If the CA discovers that the certificate used by an entity is a counterfeit, it revokes the certificate and adds it to the Certificate Revocation List (CRL)."
Demon_Queen_Velverosa
👍 1
Selected: B
The answer is B
Premium_Pils
👍 1
C) explains what a certificate is, and not what a CA is. The question is about defining the CA.
Premium_Pils
👍 1
Selected: B
The question is based on the wikipedia: https://en.wikipedia.org/wiki/Certificate_authority "In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates." You can find answer C) word by word there. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This allows others (relying parties) to rely upon signatures or on assertions made about the private key that corresponds to the certified public key. ...and a similar description to A) The certificate is also a confirmation or validation by the CA that the public key contained in the certificate belongs to the person, organization, server or other entity noted in the certificate.
Premium_Pils
👍 1
Wikipedia seems to align with answer B). A) would be correct, if it would say validation of a public key contained in a certificate.
Bubu3k
👍 1
Selected: C
I'm with Tthurston1 on this one, so C. I might be wrong, but, at the end of the day, the CA is there to confirm that only the subject can decrypt the message encrypted with its public key and that a message that can be decrypted with the public key was definitely encrypted by the subject via private. In my view C is the scope, A&B are processes done in order to achieve the goal.
Mocix
👍 1
Selected: B
CA doesn't directly validate any certificate. If you want to check if a certificate is valide, you just check if it's signed by CA( or above) and if it is still valid! So, A can not be correct! I go for B.
Tthurston1
👍 1
??? Where's your source to backup such a claim? On the contrary, CA's DO VALIDATE certificates! Taken from: www.digicert.com/blog/what-is-a-certificate-authority "However, CAs VALIDATE organizations and individuals to help ensure that only legitimate websites get a TLS certificate." "Before issuing a certificate, the CA WILL VERIFY the certificate requester’s information, like site ownership, name, location and more. CAs must adhere to stringent industry standards to ensure that every CA follows similar requirements for validation."
Tthurston1
👍 1
Selected: C
In the grand scheme of things, Options A-C are ALL VALID functions of a CA in a PKI infrastructure. But of course, you can only choose one answer..... I would opt for Option C because it emphasizes the critical aspect of verifying ownership of the PUBLIC key by the named subject.
Tthurston1
👍 1
The CA acts as a trusted entity in a PKI, verifying the identity of entities requesting digital certificates and issuing certificates that bind a public key to a trusted subject. This binding of identity to a public key is the foundation of trust in PKI-based secure communication.
not_so_free
👍 1
They are asking for CA not RootCA certificate, might be B, make more sense to me.
mikexian
👍 2
In a PKI (Public Key Infrastructure), the purpose of a CA (Certificate Authority) is to issue, manage, and revoke digital certificates. The CA plays a central role in establishing trust and enabling secure communication within the PKI ecosystem. Here are the key purposes of a CA:
CCNPWILL
👍 2
Selected: A
I agree. A is the most ligical for a CA in PKI setup.
ytsionis
👍 4
A is the only right. Issuing a digital certificate can be done also by an internal custom CA with no validity to the outside word.
Silexis
👍 1
You are not considering the revocation of certificates, which is also a role of a CA. Needless to say that by issuing a certificate, as a CA, it means to validate it is well, by digitally sign it (though here it is a bigger discussion due to the fact that if you run your own CA and, for example, are signing my CSR, it will not mean it is valid)
mazimir
👍 4
I would argue here, it could be A) as well. I as user or scripts are able to "issue" or "revoke" certificates, but only CA can grant authenticity...
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B. In a Public Key Infrastructure (PKI), the Certificate Authority (CA) is the trusted entity responsible for the lifecycle management of digital certificates. Its core functions include verifying the identity of the certificate requester (vetting), issuing the signed digital certificate, and managing revocation lists (CRLs) or OCSP responses when a certificate is compromised or expires. While the CA establishes trust by signing the certificate, the act of 'issuing' is its definitive administrative action.Why the Other Options Are Wrong
Option A is incorrect because validation of authenticity is performed by the relying party (e.g., the web browser or client) using the CA's public key to verify the signature on the certificate presented during a TLS handshake. The CA does not validate the certificate at the moment of connection; it issued it previously. Option C describes what a digital certificate is (it certifies ownership of a public key), not what the CA does. Option D is incorrect because private keys are generated by the entity requesting the certificate (the subject) or a secure hardware module, never by the CA, to ensure the private key remains secret.Community Comment Notes
Community consensus strongly supports Option B. As user XBfoundX noted, "A is not correct the relying party... validates the authenticity... The CA issues the certificate." User Premium_Pils reinforced this by citing Wikipedia definitions stating a CA is an entity that "stores, signs, and issues digital certificates," confirming that C describes the certificate, not the CA's function. User ytsionis argued for A but was countered by the technical distinction between issuance and validation.Exam Strategy
When asked about the role of a PKI component, distinguish between the entity that creates/manages the asset (Issuer/CA) and the entity that verifies it (Relying Party/Client). Keywords like 'issue', 'sign', and 'revoke' point to the CA; keywords like 'verify', 'validate', or 'check' point to the client.
Frequently Asked Questions
Why isn't validating authenticity the CA's job?
Validation is performed by the relying party (browser/server) using the CA's public key. The CA only signs/issued the cert earlier.
Does the CA create the private key?
No. The private key is generated by the certificate owner (subject) to keep it secret. The CA only handles the public key and the certificate.