In SSL Forward Proxy decryption, which two certificates can be used for certificate signing? (Choose two.)

Question

Options

• Awildcard server certificate
• Benterprise CA certificate
• Cclient certificate
• Dserver certificate
• Eself-signed CA certificate

• A
  8% (2)
• B
  88% (22)
• C
  4% (1)

Explanation

SSL Forward Proxy works by intercepting HTTPS sessions and dynamically generating a forged server certificate signed by the firewall, which the client trusts. For the firewall to sign these forged certificates, it must possess a CA (Certificate Authority) certificate with the CA flag set - meaning the certificate has the ability to sign other certificates. An enterprise CA certificate (B) issued by the organization's internal PKI and a self-signed CA certificate (E) created directly on the firewall both meet this requirement and can be deployed to client machines for trust. Wildcard server certificates (A), client certificates (C), and standard server certificates (D) are end-entity certificates - they cannot sign other certificates and therefore cannot be used for this purpose.

No community discussion yet for this question.