What is the role of the Registration Authority (RA) in PKI?

• A. It issues private keys to users
• B. The RA authenticates entities requesting certificates on behalf of the CA
• C. It stores root certificates
• D. It revokes certificates directly

Answer: (B)

In PKI, the Registration Authority is the entity that handles identity verification for certificate requests on behalf of the Certification Authority. Its job is to authenticate and validate who or what is requesting a certificate—confirming the applicant’s identity, domain control, or organizational details before a certificate is issued. Once the RA has validated the requester, it forwards the enrollment to the CA, which then issues and signs the certificate.

This role does not involve generating or distributing private keys, so keys aren’t issued by the RA. It also doesn’t store root certificates; those trust anchors are managed by the CA and its distribution points. And it doesn’t revoke certificates directly; revocation is performed by the CA (often through processes like CRLs or OCSP) after a valid revocation request.