A firewall is configured with SSL Forward Proxy decryption and has the following four enterprise certificate authorities (Cas):

Question

Options

• AEnterprise-Untrusted-CA which is a self-signed CA
• BEnterprise-Trusted-CA which is a self-signed CA
• CEnterprise-lntermediate-CA which was. in turn, issued by Enterprise-Root-CA
• DEnterprise-Root-CA which is a self-signed CA
• IEnterprise-Trusted-CA; which is verified as Forward Trust Certificate (The CA is also installed in

• A
  92% (33)
• B
  6% (2)
• I
  3% (1)

Explanation

In SSL Forward Proxy decryption, two certificates are required on the firewall: a Forward Trust certificate (presented when the origin server's certificate is trusted) and a Forward Untrust certificate (presented when the origin server's certificate is NOT trusted, alerting the user). (A) Enterprise-Untrusted-CA, being a self-signed CA that is NOT installed in the clients' trust stores, is the correct choice for the Forward Untrust role - browsers will display a warning when they encounter it, which is the intended behavior for untrusted sites. The Forward Trust certificate should be one whose CA is already trusted by client browsers, such as Enterprise-Trusted-CA (B) or one chained to Enterprise-Root-CA.

No community discussion yet for this question.