Fortinet
NSE8_812 · Question #166
An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status…
The correct answer is C. If the OCSP server is unreachable, authentication will succeed if the certificate matches the CA. See the full explanation below for the reasoning.
Question
An administrator has configured a FortiGate device to authenticate SSL VPN users using digital certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server.
Part of the FortiGate configuration is shown below:
config vpn certificate setting
set ocsp-status enable
set ocsp-default-server "FortiAuthenticator"
set ocsp-option certificate
set strict-ocsp-check enable
end
config user peer
edit _any
set ca CA_Cert
set ldap-server Training-Lab
set ldap-mode principal-name
next
end
config user group
edit "SSLVPN Users"
set member _any"
next
end
Based on this configuration, which statement is true?
Options
- AIf the OCSP response is CertStatus unknown, authentication will succeed if the certificate matches the CA.
- BOCSP checks will always go to the configured FortiAuthenticator.
- CIf the OCSP server is unreachable, authentication will succeed if the certificate matches the CA.
- DThe OCSP check of the certificate can be combined with a certificate revocation list.
How the community answered
(39 responses)- A3% (1)
- B15% (6)
- C72% (28)
- D10% (4)
Community Discussion
No community discussion yet for this question.