Frequently asked questions
Questions about certificate repositories, revocation information and the published practices that let verifiers check digital certificates.
What is a certificate repository maintained by a Certifying Authority?
A certificate repository is a publicly accessible store where a Certifying Authority publishes the trust information others need to validate certificates it has issued. It typically holds the authority's own certificates, revocation details and the documents describing how the authority operates. Verifying software reaches into this repository to confirm that a given certificate is genuine and still valid.
What is a Certificate Revocation List and how does it work?
A Certificate Revocation List, or CRL, is a signed list published by a Certifying Authority naming the certificates it has revoked before their natural expiry. Each entry usually records the certificate's serial number and the time it was revoked, and the list is refreshed and republished at intervals. A verifier downloads the current list and checks whether the certificate in question appears on it before extending trust.
What is the difference between OCSP and a CRL?
Both answer the same question of whether a certificate is still valid, but they do it differently. A CRL is a whole list that a verifier must fetch and search, whereas the Online Certificate Status Protocol lets a verifier ask about one specific certificate and receive a signed real-time response. OCSP avoids downloading a large list and gives fresher status, while CRLs can be checked even without a live connection to the authority.
What is a Certification Practice Statement?
A Certification Practice Statement, often shortened to CPS, is the document in which a Certifying Authority describes exactly how it issues, manages and revokes certificates. It covers matters such as how identities are verified, how keys are protected and what obligations subscribers and relying parties take on. Reading it tells you the assurances behind a certificate and the rules that govern its use.
Why can a digital signature fail to verify if the repository is unreachable?
When someone validates your signature, their software often tries to confirm that your certificate was valid by checking revocation information and the chain of trust published in the repository. If those sources cannot be reached, the software may be unable to complete the checks and can treat the status as unknown. Reliable access to the repository is therefore part of what keeps signatures verifiable.