A security administrator is tasked with implementing two-factor authentication for the company VPN. The VPN is currently configured to authenticate VPN users against a backend RADIUS server. New…

User private keys must never be installed on a shared device like a VPN concentrator - each private key is unique to the individual user and its disclosure would compromise that user's entire PKI identity.

The CA's private key is the root of trust for the entire PKI and must never be distributed or installed on any endpoint, as its compromise would invalidate every certificate issued by that CA.

User certificate signing by the CA is an enrollment prerequisite that occurs before deployment, not a configuration step performed on the VPN concentrator itself.

While the VPN concentrator's certificate must be CA-signed, the act of signing happens during certificate enrollment - the operational configuration required on the concentrator is installing its own private key and the CA's public certificate.

The VPN concentrator's private key must reside on the device so it can present its CA-signed certificate to connecting clients and establish authenticated TLS sessions, which is required for the concentrator to function as a PKI-enabled endpoint.

Installing the CA's public certificate on the VPN concentrator enables it to cryptographically validate and trust the certificates presented by users during authentication, preventing untrusted certificate errors from appearing during the VPN connection process.