When using CA for identity source, which method can be used to provide real-time certificate validation?