問87
頻出度★★★
PKI において, ある条件に当てはまるデジタル証明書の情報が公開されているリストとして CRL がある。このリストに掲載される条件として, 適切なものはどれか。
令和7年度 ITパスポート試験 問87
This question's explanation and your answers so far.
解説
問 87
Incorrectア
A certificate whose validity period has expired can be plainly judged to be expired from its dates, so it is known to be invalid even without being listed in the CRL. The CRL is a mechanism for announcing certificates revoked before expiry, and being expired is not the condition for inclusion.
Incorrectイ
A digital certificate always has a validity period (a start date and an end date); a certificate with an unlimited period does not exist. This is unrelated to the CRL's inclusion condition, and the premise itself does not hold.
- ウ
正解 A CRL (Certificate Revocation List) is a list, published by the certificate authority (CA), of certificates it has issued that have been revoked for some reason even though their validity period has not yet expired. When events such as a private key leak, incorrect certificate information, or the holder's resignation or business closure occur, the certificate must be invalidated (revoked) without waiting for its validity period to expire. By referring to the CRL, users can identify certificates that should no longer be trusted even though they are still within their validity period. Therefore, the condition for being included in the list is that the certificate has been revoked within its validity period, so ウ is correct.
Incorrectエ
The validity period of an already-issued certificate cannot be extended afterward. To extend the period, a new certificate must be reissued (renewed). This is unrelated to the CRL's inclusion condition.
ここがポイント
- A CRL (Certificate Revocation List) is a list that publishes digital certificates which have been revoked even though they are still within their validity period; the main cause of revocation is things like a private key leak.
- Revocation (revoke) and expiry of the validity period (expire) are different concepts. The CRL deals with the former (revocation within the validity period); the latter can be plainly judged invalid from the dates and is therefore not a target of the CRL.
用語