300-820 · Question #203
For TLS encryption to work between a client and a server, which of the following conditions must be met?
The correct answer is A. The client must trust the CA that signed the certificate used by the server B. The server must have a certificate installed that verifies its identity, which is issued by a CA. TLS encryption requires the server to present a CA-signed certificate and the client to trust that CA, establishing mutual identity verification before encrypted communication begins.
Question
For TLS encryption to work between a client and a server, which of the following conditions must be met?
Options
- AThe client must trust the CA that signed the certificate used by the server
- BThe server must have a certificate installed that verifies its identity, which is issued by a CA
- CThe client should always talk via a certificate proxy to the subordinate CA
How the community answered
(30 responses)- A87% (26)
- C13% (4)
Why each option
TLS encryption requires the server to present a CA-signed certificate and the client to trust that CA, establishing mutual identity verification before encrypted communication begins.
The client must have the signing CA's certificate in its trusted CA store; without this trust anchor, the client cannot verify the server's identity and the TLS handshake will fail.
The server must possess a valid certificate issued by a CA that asserts its identity; this certificate is presented during the TLS handshake so the client can validate the server.
TLS does not require a certificate proxy to a subordinate CA; clients communicate directly with servers and validate the certificate chain back to a trusted root CA without an intermediary proxy.
Concept tested: TLS certificate trust and handshake requirements
Source: https://learn.microsoft.com/en-us/windows-server/security/tls/tls-ssl-schannel-ssp-overview
Topics
Community Discussion
No community discussion yet for this question.