CAS-005 · Question #468
A system of globally distributed certificate servers connected to HSMs provide certificate security services for a publicly available PKI. These services include OCSP, certificate revocation list…
The correct answer is C. Shorten the time the duration certificates are valid to 72 hours and implement ACME. Shortening the certificate validity period and implementing ACME reduces reliance on OCSP by enabling more frequent automated certificate issuance and renewal, thereby decreasing OCSP query load and response times. This approach helps rule out HSM-to-certificate server…
Question
A system of globally distributed certificate servers connected to HSMs provide certificate security services for a publicly available PKI. These services include OCSP, certificate revocation list issuance, and certificate signing/issuance. The HSMs are all physical devices. All other servers are virtualized. Each global site has a network load balancer, and the sites are configured to load balance between sites. Users report occasional but persistent log-on failures to different PKI-enabled websites. There is no apparent pattern to the failures. Some OCSP responses must be signed by the HSM. Each HSM is connected to a physical server containing multiple VMs for the local site with CAT 6e network cable. The backplane connecting the VMs is fiber based. Which of the following would best reduce the OCSP response time in order to rule out the connection between the certificate server and HSM as a cause of the user-reported issues?
Options
- AVirtualize the HSMs and convert the virtualized servers to physical systems.
- BReplace the copper-based network infrastructure with fiber.
- CShorten the time the duration certificates are valid to 72 hours and implement ACME.
- DReduce the number of global sites while increasing the number of HSMs.
How the community answered
(25 responses)- A12% (3)
- B8% (2)
- C60% (15)
- D20% (5)
Explanation
Shortening the certificate validity period and implementing ACME reduces reliance on OCSP by enabling more frequent automated certificate issuance and renewal, thereby decreasing OCSP query load and response times. This approach helps rule out HSM-to-certificate server connection delays as the cause of user log-on failures.
Community Discussion
No community discussion yet for this question.