A security engineer is deploying certificate-based authentication for a corporate PKI. During validation testing, a client presents a certificate that was administratively invalidated by the CA two hours ago, yet the client is still granted access. The engineer needs to ensure the authenticating device performs a real-time query to confirm a certificate has not been revoked before trusting it. Which PKI component provides this function?