CA vs RA CRL Publishing Limitation

350-701 By islever Editorial Last updated

Describe cryptography security components such as hashing, encryption, PKI, SSL, TLS, QUIC, MASQUE, IPsec, NAT-T IPv4 for IPsec, preshared key, certificate-based authorization, and post-quantum cryptography

Short answer

A Certificate Authorities publish CRLs, which is a limitation for Registration Authorities that can only submit revocation requests.

Question

Which function is performed by certificate authorities but is a limitation of registration authorities?
  1. CRL publishing Correct Answer
  2. certificate re-enrollment
  3. verifying user identity
  4. accepts enrollment requests

Key Takeaways

The question tests the division of labor in PKI; the common trap is assuming RAs verify identities exclusively without understanding that CRL publishing is strictly a CA function.

Certificate Authorities (CAs) are responsible for publishing Certificate Revocation Lists (CRLs), a function that Registration Authorities (RAs) are limited in performing. This page explains the distinct roles of CAs and RAs within a PKI framework.

Common mistake: Choosing C (verifying user identity) because it seems like an RA task, missing that the question asks what CAs do that RAs are limited in, which is CRL publishing.

Expert Analysis

Why the Answer Is Correct

CAs are responsible for generating and publishing Certificate Revocation Lists (CRLs) to indicate which certificates are no longer valid. While an RA can accept and process revocation requests from users, it lacks the authority and cryptographic capability to actually publish the CRL. This is a core limitation of the RA and a primary function of the CA.

Why the Other Options Are Wrong

Option C is incorrect because verifying user identity is the primary role of an RA, not a limitation of it. Option D is incorrect because accepting enrollment requests is also a core function of an RA, not a limitation. Option B is incorrect because while an RA can accept re-enrollment requests, the actual cryptographic re-enrollment (signing) is performed by the CA; however, CRL publishing is entirely outside the RA's scope, making A the best answer.

Community Comment Notes

Commenters overwhelmingly agree that CRL publishing is the correct distinction between a CA and an RA. As sull3y noted, "CAs are responsible for issuing digital certificates... while RAs are responsible for verifying the identity". Another user pointed out that an RA "does everything EXCEPT the issuing of the CERT" and while it handles revocation requests, it does not publish the CRL itself.

Official Reference

https://www.techtarget.com/searchsecurity/definition/registration-authority

This link opens the official vendor documentation in a new tab.

Exam Strategy

When distinguishing between CA and RA functions, remember that the CA handles all cryptographic signing and public trust functions, such as issuing certificates and publishing CRLs. The RA acts as an intermediary handling identity verification and request processing, but never publishes trusted data itself.

Discussion 25 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 25

  1. Cippy18 👍 4 Answered A
    The RA does verify identities....I think C is wrong, I believe is A
  2. ums008 👍 4 Answered A
    A is correct, this website needs update
  3. ReeemQ 👍 4
    CRL publishing
  4. sull3y 👍 3
    The function performed by certificate authorities (CAs) but is a limitation of registration authorities (RAs) is "CRL publishing". CAs are responsible for issuing digital certificates to entities and managing the public key infrastructure (PKI) system, while RAs are responsible for verifying the identity of the entity requesting the certificate and forwarding the request to the CA. CRL (Certificate Revocation List) publishing involves maintaining a list of revoked certificates and making it available to users and relying parties. This function is typically performed by CAs, as they are the ones responsible for managing the certificates they issue and revoking them if necessary.
  5. NoUserName1234 👍 3
    Look @ this https://www.techtarget.com/searchsecurity/definition/registration-authority Here it states that it does everyting EXCEPT the issuing of the CERT. It also does revocation. In short, answer 'A'
Show 20 more comments
  1. hous90 👍 3
    The answer should be (A) CRL. I didn't pay an attention to limitation in the question
  2. CCNP21 👍 3 Answered A
    I vote A
  3. Tthurston1 👍 2
    Interesting question lol.... A & C are the best possible answers here..... CRL Publishing is primarily a CA's responsibility. An RA CAN also handle revocation requests, but this function is LIMITED to an administrative task rather than a core responsibility. Regarding user identity verification, a CA authenticates the identities of entities requesting digital certificates, ensuring that they possess the private key corresponding to the public key issued in the digital certificate. An RA is LIMITED in the fact that they do not perform full identity verification themselves, but rather assist in verifying the identity of the entity requesting the certificate. Which answer is the BEST? I would vote for C. My reason is because in this particular instance, an RA just do not possess the authority or capability to fully verify user identities.
  4. Tthurston1 👍 2
    Verifying user identities IS actually apart of a CA's responsibility. "CAs VALIDATE organizations AND individuals to help ensure that only legitimate websites get a TLS certificate." Before issuing a certificate, the CA WILL VERIFY the certificate requester’s information, like site ownership, name, location and more. CAs must adhere to stringent industry standards to ensure that every CA follows similar requirements for validation." Source: https://www.digicert.com/blog/what-is-a-certificate-authority
  5. hous90 👍 2 Answered C
    The Answer is C In CISSP 8th Edition guide the following is mentioned: Registration authorities (RAs) assist CAs with the burden of verifying users’ identities prior to issuing digital certificates. They do not directly issue certificates themselves, but they play an important role in the certification process, allowing CAs to remotely validate user identities.
  6. holydolev 👍 2 Answered C
    Here's why option A (CRL publishing) isn't a clear distinction between CAs and RAs: While CAs have the primary responsibility for CRL generation and publishing, RAs can be involved in the distribution process. Verify user identity is very limited on RA, comparing to CA.
  7. jienBoq 👍 2 Answered C
    A registration authority (RA) is an authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it.
  8. minous123 👍 2
    C is correct if you rearrange the question (CA <> RA) CA is responsible for all the tasks except verifying user identity.
  9. smartcarter 👍 2
    The RA can also verify user identities but cannot publish CRLs for instance or issue certificates
  10. ffaiz 👍 1 Answered C
    The certificate request is sent to the PKI's RA to verify that the requestor has the right to request the certificate. The RA verifies the identity of the user and device and processes authentication credentials. If everything checks out, the RA forwards the certificate request to the CA to process. The CA then issues the digital certificate directly to the requesting device. If the RA denies the request, the requesting user or device is not permitted to continue the certificate request process. https://www.techtarget.com/searchsecurity/definition/registration-authority#:~:text=The%20certificate%20request%20is,the%20certificate%20request%20process.
  11. Rododendron2 👍 1 Answered A
    Don´t get what all those comments are about. What function is performed by CA ? Clearly issue CRL : A Why someone here even mentions verify user Identity is CA job ? It is server job to verify clients certificate, verification is not job of CA itself. CA is queried just to verify the client's certificate is not tempered, not doing authentication.
  12. XBfoundX 👍 1 Answered A
    A Registration Authority (RA) in a Public Key Infrastructure (PKI) is a trusted subsystem or separate entity that handles identity proofing, user authentication, and validation of certificate signing requests before passing them to a Certificate Authority (CA) for final digital signing and issuance
  13. MPoels 👍 1 Answered A
    In summary, while the primary responsibility for CRL publishing typically rests with the CA, in certain scenarios, an RA may be delegated authority to assist with CRL management under the oversight and control of the CA.
  14. stalkr3 👍 1
    The certificate request is sent to the PKI's RA to verify that the requestor has the right to request the certificate. The RA verifies the identity of the user and device and processes authentication credentials.
  15. smartcarter 👍 1
    The question is asking for operations a CA can do that an RA cannot. In a standard single CA deployment, the CA does everything including identity verification, which makes C wrong.
  16. stalkr3 👍 1
    "A registration authority (RA) is an authority in a network that verifies user requests for a digital certificate and tells the certificate authority (CA) to issue it. "
  17. Emlia1 👍 1
    A or C, I am not sure
  18. smartcarter 👍 1
    A and B seem correct
  19. Emlia1 👍 1
    I prefer C
  20. Premium_Pils 👍 1
    I agree

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide