CA vs RA CRL Publishing Limitation
Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography
Which function is performed by certificate authorities but is a limitation of registration authorities?
Answer
Correct answer: A — Certificate Authorities publish CRLs, which is a limitation for Registration Authorities that can only submit revocation requests.
Community Insight
The question tests the division of labor in PKI; the common trap is assuming RAs verify identities exclusively without understanding that CRL publishing is strictly a CA function.
Certificate Authorities (CAs) are responsible for publishing Certificate Revocation Lists (CRLs), a function that Registration Authorities (RAs) are limited in performing. This page explains the distinct roles of CAs and RAs within a PKI framework.
Choosing C (verifying user identity) because it seems like an RA task, missing that the question asks what CAs do that RAs are limited in, which is CRL publishing.
Community Discussion (25 comments)
XBfoundX
👍 1
Selected: A
A Registration Authority (RA) in a Public Key Infrastructure (PKI) is a trusted subsystem or separate entity that handles identity proofing, user authentication, and validation of certificate signing requests before passing them to a Certificate Authority (CA) for final digital signing and issuance
Rododendron2
👍 1
Selected: A
Don´t get what all those comments are about. What function is performed by CA ? Clearly issue CRL : A Why someone here even mentions verify user Identity is CA job ? It is server job to verify clients certificate, verification is not job of CA itself. CA is queried just to verify the client's certificate is not tempered, not doing authentication.
Tthurston1
👍 2
Verifying user identities IS actually apart of a CA's responsibility. "CAs VALIDATE organizations AND individuals to help ensure that only legitimate websites get a TLS certificate." Before issuing a certificate, the CA WILL VERIFY the certificate requester’s information, like site ownership, name, location and more. CAs must adhere to stringent industry standards to ensure that every CA follows similar requirements for validation." Source: https://www.digicert.com/blog/what-is-a-certificate-authority
Tthurston1
👍 2
Interesting question lol.... A & C are the best possible answers here..... CRL Publishing is primarily a CA's responsibility. An RA CAN also handle revocation requests, but this function is LIMITED to an administrative task rather than a core responsibility. Regarding user identity verification, a CA authenticates the identities of entities requesting digital certificates, ensuring that they possess the private key corresponding to the public key issued in the digital certificate. An RA is LIMITED in the fact that they do not perform full identity verification themselves, but rather assist in verifying the identity of the entity requesting the certificate. Which answer is the BEST? I would vote for C. My reason is because in this particular instance, an RA just do not possess the authority or capability to fully verify user identities.
holydolev
👍 2
Selected: C
Here's why option A (CRL publishing) isn't a clear distinction between CAs and RAs: While CAs have the primary responsibility for CRL generation and publishing, RAs can be involved in the distribution process. Verify user identity is very limited on RA, comparing to CA.
MPoels
👍 1
Selected: A
In summary, while the primary responsibility for CRL publishing typically rests with the CA, in certain scenarios, an RA may be delegated authority to assist with CRL management under the oversight and control of the CA.
ums008
👍 4
Selected: A
A is correct, this website needs update
ffaiz
👍 1
Selected: C
The certificate request is sent to the PKI's RA to verify that the requestor has the right to request the certificate. The RA verifies the identity of the user and device and processes authentication credentials. If everything checks out, the RA forwards the certificate request to the CA to process. The CA then issues the digital certificate directly to the requesting device. If the RA denies the request, the requesting user or device is not permitted to continue the certificate request process. https://www.techtarget.com/searchsecurity/definition/registration-authority#:~:text=The%20certificate%20request%20is,the%20certificate%20request%20process.
sull3y
👍 3
The function performed by certificate authorities (CAs) but is a limitation of registration authorities (RAs) is "CRL publishing". CAs are responsible for issuing digital certificates to entities and managing the public key infrastructure (PKI) system, while RAs are responsible for verifying the identity of the entity requesting the certificate and forwarding the request to the CA. CRL (Certificate Revocation List) publishing involves maintaining a list of revoked certificates and making it available to users and relying parties. This function is typically performed by CAs, as they are the ones responsible for managing the certificates they issue and revoking them if necessary.
Premium_Pils
👍 1
I agree
stalkr3
👍 1
"A registration authority (RA) is an authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it. "
stalkr3
👍 1
The certificate request is sent to the PKI's RA to verify that the requestor has the right to request the certificate. The RA verifies the identity of the user and device and processes authentication credentials.
minous123
👍 2
C is correct if you rearrange the question (CA <> RA) CA is responsible for all the tasks except verifying user identity.
Cippy18
👍 4
Selected: A
The RA does verify identities....I think C is wrong, I believe is A
jienBoq
👍 2
Selected: C
A registration authority (RA) is an authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it.
CCNP21
👍 3
Selected: A
I vote A
Emlia1
👍 1
I prefer C
Emlia1
👍 1
A or C, I am not sure
NoUserName1234
👍 3
Look @ this https://www.techtarget.com/searchsecurity/definition/registration-authority Here it states that it does everyting EXCEPT the issuing of the CERT. It also does revocation. In short, answer 'A'
hous90
👍 3
The answer should be (A) CRL. I didn't pay an attention to limitation in the question
smartcarter
👍 2
The RA can also verify user identities but cannot publish CRLs for instance or issue certificates
hous90
👍 2
Selected: C
The Answer is C In CISSP 8th Edition guide the following is mentioned: Registration authorities (RAs) assist CAs with the burden of verifying users’ identities prior to issuing digital certificates. They do not directly issue certificates themselves, but they play an important role in the certification process, allowing CAs to remotely validate user identities.
smartcarter
👍 1
The question is asking for operations a CA can do that an RA cannot. In a standard single CA deployment, the CA does everything including identity verification, which makes C wrong.
smartcarter
👍 1
A and B seem correct
ReeemQ
👍 4
CRL publishing
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CAs are responsible for generating and publishing Certificate Revocation Lists (CRLs) to indicate which certificates are no longer valid. While an RA can accept and process revocation requests from users, it lacks the authority and cryptographic capability to actually publish the CRL. This is a core limitation of the RA and a primary function of the CA.Why the Other Options Are Wrong
Option C is incorrect because verifying user identity is the primary role of an RA, not a limitation of it. Option D is incorrect because accepting enrollment requests is also a core function of an RA, not a limitation. Option B is incorrect because while an RA can accept re-enrollment requests, the actual cryptographic re-enrollment (signing) is performed by the CA; however, CRL publishing is entirely outside the RA's scope, making A the best answer.Community Comment Notes
Commenters overwhelmingly agree that CRL publishing is the correct distinction between a CA and an RA. As sull3y noted, "CAs are responsible for issuing digital certificates... while RAs are responsible for verifying the identity". Another user pointed out that an RA "does everything EXCEPT the issuing of the CERT" and while it handles revocation requests, it does not publish the CRL itself.Official Reference
Exam Strategy
When distinguishing between CA and RA functions, remember that the CA handles all cryptographic signing and public trust functions, such as issuing certificates and publishing CRLs. The RA acts as an intermediary handling identity verification and request processing, but never publishes trusted data itself.