A Citrix Administrator needs to confirm that all client certificates presented to the authentication virtual server are valid until at least the year 2023. Which expression can the administrator use…

Question

Options

• ACLIENT.SSL.CLIENT_CERT.DAYS_TO_EXPIRE.EQ(2023)
• BCLIENT.SSL.CLIENT_CERT.VALID_NOT_BEFORE.EQ(GMT2023)
• CCLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2023)
• DCLIENT.SSL.ORIGIN_SERVER_CERT.VALID_NOT_AFTER.EQ(GMT2023)

• A
  15% (7)
• B
  72% (34)
• C
  9% (4)
• D
  4% (2)

Explanation

Option B is marked as correct in this answer key, but there is a significant semantic issue worth flagging: the stated correct answer appears to be wrong. VALID_NOT_BEFORE is the certificate's start date (the date before which the cert is invalid), not its expiration. To verify a certificate is valid until at least 2023, you need to check VALID_NOT_AFTER - the expiration date - making C the more logically sound answer.

Why each option fails:

• A (DAYS_TO_EXPIRE.EQ(2023)) is wrong because 2023 is a calendar year, not a number of days remaining - this expression compares a day-count integer, not a date.
• B (VALID_NOT_BEFORE) checks the certificate's issuance/start date, which has no bearing on when it expires.
• C (CLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2023)) checks the expiration date on the client certificate - this is the semantically correct field for "valid until 2023."
• D (ORIGIN_SERVER_CERT) checks the origin server's certificate, not the client's certificate presented to the authentication virtual server.

Memory tip: NOT_AFTER = "not valid after this date" = expiration. NOT_BEFORE = "not valid before this date" = start date. For expiry checks, always reach for NOT_AFTER. If your exam marks B as correct, this appears to be an error in the answer key - treat C as the defensible answer in real-world application.

No community discussion yet for this question.