PCNSE · Question #301
Which is not a valid reason for receiving a decrypt-cert-validation error?
The correct answer is A. Unsupported HSM. The decrypt-cert-validation error is triggered when the firewall encounters a certificate-related problem during SSL/TLS decryption policy processing. Valid reasons for this error include: Unknown certificate status (the revocation status cannot be determined), Client…
Question
Which is not a valid reason for receiving a decrypt-cert-validation error?
Options
- AUnsupported HSM
- BUnknown certificate status
- CClient authentication
- DUntrusted issuer
How the community answered
(19 responses)- A89% (17)
- C5% (1)
- D5% (1)
Explanation
The decrypt-cert-validation error is triggered when the firewall encounters a certificate-related problem during SSL/TLS decryption policy processing. Valid reasons for this error include: Unknown certificate status (the revocation status cannot be determined), Client authentication (the certificate is being used for mutual TLS/client auth, which the firewall cannot proxy), and Untrusted issuer (the certificate chain leads to a CA not trusted by the firewall). 'Unsupported HSM' (Hardware Security Module) is NOT a valid decrypt-cert-validation reason - HSM support relates to where private keys are stored for the firewall's own certificates, not to the validation of remote server or client certificates encountered during decryption.
Topics
Community Discussion
No community discussion yet for this question.