Which scenario commonly leads to revocation of a certificate?

• A. Compromised
• B. Expired
• C. Certificate Renewal
• D. Change of password for the user

Answer: (A)

When a certificate’s private key has been compromised or there’s a credible belief that the holder should no longer be trusted, revocation is used to stop its trust before the certificate expires. Administrators publicly announce this status through mechanisms like a Certificate Revocation List (CRL) or OCSP so that clients and systems won’t accept the certificate anymore.

An expired certificate, on the other hand, simply reaches the end of its validity window and becomes unusable by design, without any revocation action needed. Renewal relates to obtaining a new certificate to replace or extend the old one, not specifically to revoking the existing one. A password change for the user doesn’t automatically revoke the certificate; it may be advisable if there’s evidence of key compromise, but the act of changing a password alone does not constitute revocation.