1Y0-301 · Question #2
Scenario: StoreFront is currently being used to access internal resources. A Citrix Engineer needs to create a single Fully Qualified Domain Name (FQDN) to access a store internally and externally…
The correct answer is C. Third-party multi-domain certificate with Subject Alternative Name. A third-party multi-domain SAN certificate covers both internal and external FQDNs and is trusted by default on unmanaged devices without additional CA configuration.
Question
Scenario: StoreFront is currently being used to access internal resources. A Citrix Engineer needs to create a single Fully Qualified Domain Name (FQDN) to access a store internally and externally for the current StoreFront server. The internal FQDN is inside.company.com and the external FQDN is outside.company.com. Which kind of certificate should the engineer generate to support a wide range of unmanaged devices?
Options
- ASelf-signed server certificate
- BThird-party signed server certificate
- CThird-party multi-domain certificate with Subject Alternative Name
- DEnterprise Root CA Signed certificate with Subject Alternative Name
How the community answered
(23 responses)- A4% (1)
- B17% (4)
- C74% (17)
- D4% (1)
Why each option
A third-party multi-domain SAN certificate covers both internal and external FQDNs and is trusted by default on unmanaged devices without additional CA configuration.
Self-signed certificates are not trusted by default on any device and would generate certificate warnings on unmanaged devices that cannot be pre-configured with the cert.
A single third-party server certificate covers only one FQDN (or wildcard), not two distinct FQDNs like inside.company.com and outside.company.com simultaneously.
A third-party certificate with Subject Alternative Names (SANs) can include both inside.company.com and outside.company.com in a single certificate, satisfying the single-cert requirement. Third-party certificates from public CAs are trusted by default on unmanaged devices because their root CAs are pre-installed in operating systems and browsers, requiring no additional certificate deployment.
An Enterprise Root CA certificate is only trusted on domain-joined or managed devices where the enterprise CA has been deployed via Group Policy - unmanaged devices would not trust it.
Concept tested: Multi-domain SAN certificate for split-DNS StoreFront access
Source: https://docs.citrix.com/en-us/storefront/current-release/install-and-set-up-storefront.html
Topics
Community Discussion
No community discussion yet for this question.