Which three pieces of information does FortiGate use to identify the hostname of the SSL server when SSL certificate inspection is enabled? (Choose three.)

Question

Options

• AThe host field in the HTTP header.
• BThe server name indication (SNI) extension in the client hello message.
• CThe subject alternative name (SAN) field in the server certificate.
• DThe subject field in the server certificate.
• EThe serial number in the server certificate.

• A
  9% (4)
• B
  76% (35)
• E
  15% (7)

Explanation

When SSL certificate inspection is enabled, FortiGate needs to determine the hostname of the SSL server to apply appropriate policies. It uses three sources: (B) the Server Name Indication (SNI) extension in the TLS ClientHello message - the client explicitly advertises the hostname it intends to connect to before the certificate is exchanged; (C) the Subject Alternative Name (SAN) field in the server certificate - lists all valid hostnames the certificate covers and is the modern standard for hostname validation; (D) the Subject field (specifically the Common Name/CN) in the server certificate - the legacy field identifying the primary hostname. Answer A (HTTP Host header) is an application-layer field used in HTTP/1.1 but is not accessible during SSL/TLS inspection at the certificate inspection level. Answer E (serial number) uniquely identifies the certificate but carries no hostname information.

No community discussion yet for this question.