nerdexam
Fortinet

FCSS_NST_SE-7.6 · Question #23

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which action will…

The correct answer is D. FortiGate uses the CN information from the Subject field in the server certificate. #Config firewall ssl-ssh-profile edit <profile_name> set sni-server-cert-check [enable* | strict | disable] Enable: If the SNI does NOT match the CN or SAN fields in the returned server's certificate, FG uses the CN field instead of the SNI to obtain the FQDN. Strict: If the…

Troubleshoot Proxy and Flow-based Inspection Issues

Question

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which action will FortiGate take when using the default settings for SSL certificate inspection?

Options

  • AFortiGate uses the SNI from the user's web browser.
  • BFortiGate closes the connection because this represents an invalid SSL/TLS configuration.
  • CFortiGate uses the first entry listed in the SAN field in the server certificate.
  • DFortiGate uses the CN information from the Subject field in the server certificate.

How the community answered

(32 responses)
  • A
    13% (4)
  • B
    3% (1)
  • C
    3% (1)
  • D
    81% (26)

Explanation

#Config firewall ssl-ssh-profile edit <profile_name> set sni-server-cert-check [enable* | strict | disable] Enable: If the SNI does NOT match the CN or SAN fields in the returned server's certificate, FG uses the CN field instead of the SNI to obtain the FQDN. Strict: If the SNI does NOT match the CN or SAN fields in the returned server's certificate, FG closes the connection. Disable: FG does not check the SNI.

Topics

#SSL certificate inspection#SNI#CN#SAN mismatch

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full FCSS_NST_SE-7.6 Practice