NSE4_FGT-7.0 · Question #89
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
The correct answer is A. The keyUsage extension must be set to keyCertSign. D. The CA extension must be set to TRUE. For a certificate to function as a Certificate Authority (CA) for SSL inspection, it must possess specific extensions that allow it to sign other certificates.
Question
Which two attributes are required on a certificate so it can be used as a CA certificate on SSL Inspection? (Choose two.)
Options
- AThe keyUsage extension must be set to keyCertSign.
- BThe common name on the subject field must use a wildcard name.
- CThe issuer must be a public CA.
- DThe CA extension must be set to TRUE.
How the community answered
(23 responses)- A91% (21)
- B4% (1)
- C4% (1)
Why each option
For a certificate to function as a Certificate Authority (CA) for SSL inspection, it must possess specific extensions that allow it to sign other certificates.
The `keyUsage` extension of a CA certificate must be set to include `keyCertSign` to authorize the certificate's private key to sign other certificates, which is essential for a firewall performing SSL deep inspection.
A wildcard name in the common name field is typically used for server certificates to cover multiple subdomains, but it is not a required attribute for the CA certificate itself.
The issuer of a CA certificate for SSL inspection does not have to be a public CA; it can be a self-signed certificate or issued by a private enterprise CA for internal network use.
A certificate used as a CA must have the `Basic Constraints` extension with the `CA` flag set to `TRUE`, explicitly marking it as a Certificate Authority and enabling it to issue subordinate certificates in a trust chain.
Concept tested: CA certificate requirements for SSL inspection
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/certificate-extensions
Topics
Community Discussion
No community discussion yet for this question.