Fortinet
NSE8_812 · Question #24
An administrator has configured a FortiGate device to authenticate SSL VPN users using dogotal certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status…
The correct answer is A. OCSP checks will always go to the configured FortiAuthenticator B. The OCSP check of the certificate can be combined with a certificate revocation list. See the full explanation below for the reasoning.
Question
An administrator has configured a FortiGate device to authenticate SSL VPN users using dogotal certificates. A FortiAuthenticator is the certificate authority (CA) and the Online Certificate Status Protocol (OCSP) server. Part of the FortiGate configuration is shown below:
config vpn certificate setting
set ocsp-status enable
set ocsp-default-server "FortiAuthenticator"
set ocsp-option certificate
set strict-ocsp-check enable
end
config user peer
edit _any
set ca CA_Cert
set ldap-server Training-Lab
set ldap-mode principal-name
next
end
config user group
edit "SSLVPN_Users"
set member "_any"
next
end
Based on this configuration, which two statements are true? (Choose two.)Options
- AOCSP checks will always go to the configured FortiAuthenticator
- BThe OCSP check of the certificate can be combined with a certificate revocation list
- COCSP certificate responses are never cached by the FortiGate
- DIf the OCSP server is unreachable, authentication will succeed if the certificate matches the CA
How the community answered
(54 responses)- A76% (41)
- C15% (8)
- D9% (5)
Community Discussion
No community discussion yet for this question.