How is the Forward Untrust Certificate used?

The correct answer is C. It is presented to clients when the server they are connecting to is signed by a certificate authority. The Forward Untrust Certificate is used during SSL/TLS Forward Proxy decryption when a client connects to a server whose certificate is signed by an untrusted or unknown Certificate Authority (CA) - for example, a self-signed certificate. Because the firewall cannot validate…

Submitted by viktor_hu· Apr 18, 2026Deploy and Configure

Question

Options

AIt issues certificates encountered on the Untrust security zone when clients attempt to connect to
BIt is used when web servers request a client certificate.
CIt is presented to clients when the server they are connecting to is signed by a certificate authority
DIt is used for Captive Portal to identify unknown users.

How the community answered

(26 responses)

A
8% (2)
C
88% (23)
D
4% (1)

Explanation

The Forward Untrust Certificate is used during SSL/TLS Forward Proxy decryption when a client connects to a server whose certificate is signed by an untrusted or unknown Certificate Authority (CA) - for example, a self-signed certificate. Because the firewall cannot validate the server's certificate chain, it presents the Forward Untrust Certificate to the client to signal that the server is untrusted, while still enabling decryption and inspection. This is distinct from the Forward Trust Certificate, which is used when the server's CA is trusted. The Forward Untrust Certificate is not used for Captive Portal (D) or client certificate requests (B).

Topics

#SSL Decryption#Forward Proxy#Certificates#Security Zones

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice