Question: When a Network Element Certificate Authority (NE CA) is removed from a telecom network, what is the required action for its certificate and unexpired certificates issued to Network Elements (NEs)?
Option 1: Immediately revoke all associated certificates, but only update CRLs (Certificate Revocation Lists) during scheduled maintenance.
Option 2: Invalidate the NE CA's private key without notifying any NEs or updating revocation status servers.
Option 3: Ensure the NE CA certificate and all its unexpired issued certificates to NEs are listed in either CRLs (Certificate Revocation Lists) or an OCSP (Online Certificate Status Protocol) server.
Option 4: Automatically expire all associated certificates within a short grace period without updating revocation status servers.
Explanation: This action ensures the security and trust of the network are maintained after an NE CA's removal. By listing the certificates in CRLs or making their status available through an OCSP server, the network can efficiently verify and prevent the use of revoked or untrusted certificates, thus protecting against potential security breaches. This approach aligns with best practices for managing certificate lifecycles in secure telecom environments.