FCSS_EFW_AD-7.6 · Question #70
Refer to the exhibit, which shows an SSL certification inspection configuration. SSL certification inspection configuration While testing, the administrator updated the ssl-ssh-profile configuration…
The correct answer is B. FortiGate closes the connection because this represents an invalid SSL/TLS header. When sni-server-cert-check is set to strict, FortiGate enforces zero-tolerance certificate validation: if the SNI presented by the client's browser doesn't match the CN or any SAN in the server's certificate, FortiGate treats the SSL/TLS handshake as invalid and terminates the…
Question
Refer to the exhibit, which shows an SSL certification inspection configuration. SSL certification inspection configuration While testing, the administrator updated the ssl-ssh-profile configuration with the command set sni-server-cert-check strict. The administrator found that the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. With respect to the set sni-server-cert-check strict command, which action does FortiGate take?
Exhibit
Options
- AFortiGate uses the first entry listed in the SAN field in the server certificate.
- BFortiGate closes the connection because this represents an invalid SSL/TLS header.
- CFortiGate uses the CN information from the Subject field in the server certificate.
- DFortiGate uses the SNI from the user's web browser.
How the community answered
(23 responses)- A4% (1)
- B74% (17)
- C13% (3)
- D9% (2)
Explanation
When sni-server-cert-check is set to strict, FortiGate enforces zero-tolerance certificate validation: if the SNI presented by the client's browser doesn't match the CN or any SAN in the server's certificate, FortiGate treats the SSL/TLS handshake as invalid and terminates the connection immediately, blocking access to protect against potential MITM attacks or certificate misuse.
Why the distractors are wrong:
- A is wrong because strict mode does not fall back to any SAN entry - a mismatch means termination, full stop.
- C is wrong for the same reason - strict mode does not fall back to the CN field; that behavior describes a more permissive check mode.
- D is wrong because FortiGate is already using the SNI from the browser - that's exactly what it compared against the certificate and found mismatched; this isn't a corrective action.
Memory tip: Think of "strict" as "Stop, Terminate, Refuse Invalid Certificates Totally" - in strict mode, any SNI/certificate mismatch = connection closed, no fallbacks, no exceptions.
Topics
Community Discussion
No community discussion yet for this question.