An enterprise client is on-boarding an AEM Desktop application to provide authors with the ability to load the AEM repository virtually on the file system. The desktop application is unable to…

Question

Options

• AInstall the certificate chain to the keystore of the AEM authentication service user
• BInstall the Root certificate to the AEM truststore
• CInstall the certificate chain to the keystore of the AEM ssl-service user
• DInstall the certificate chain to the AEM truststore

• A
  3% (1)
• B
  75% (24)
• C
  16% (5)
• D
  6% (2)

Explanation

Option B is correct because when AEM Desktop connects to an SSL-enabled AEM Author, AEM must be able to validate the server's certificate chain up to a trusted root. Adding the Root CA certificate to the AEM Global Truststore tells AEM to trust that certificate authority - the intermediate cert is already present on Apache, so only the root anchor is missing from AEM's trust chain.

Why the distractors fail:

• A (authentication service user keystore): Keystores hold private keys and identity certificates for a service acting as a server; the authentication service user has no role in outbound SSL trust validation.
• C (ssl-service user keystore): The ssl-service system user's keystore stores AEM's own private key and certificate for serving HTTPS - it controls what AEM presents, not what AEM trusts.
• D (certificate chain to truststore): The location (truststore) is right, but installing the full chain is wrong here - the intermediate is already on Apache. Redundantly adding the chain conflates the problem; only the Root certificate is the missing trust anchor.

Memory tip: Think of it as a vault analogy - the Truststore holds certificates you trust others by (outbound/client-side SSL), while Keystores hold certificates you identify yourself with (inbound/server-side SSL). When AEM can't trust a remote SSL endpoint, the fix lives in the Truststore, and you install the Root, not the intermediate that's already deployed upstream.

No community discussion yet for this question.