An engineer is tasked with configuring SSL forward proxy for traffic going to external sites. Which of the following statements is consistent with SSL decryption best practices?

Question

Options

• AThe forward trust certificate should not be stored on an HSM.
• BThe forward untrust certificate should be signed by a certificate authority that is trusted by the
• CCheck both the Forward Trust and Forward Untrust boxes when adding a certificate for use with
• DThe forward untrust certificate should not be signed by a Trusted Root CA.

• A
  4% (1)
• B
  9% (2)
• C
  4% (1)
• D
  83% (19)

Explanation

SSL Forward Proxy uses two certificates: a 'Forward Trust' certificate (presented when the origin server's certificate is trusted) and a 'Forward Untrust' certificate (presented when the origin server's certificate is NOT trusted). Best practice dictates that the Forward Untrust certificate should NOT be signed by a trusted root CA (Option D). If it were signed by a trusted CA, browsers would silently accept it and users would receive no warning when visiting sites with untrusted or invalid certificates, defeating the purpose of the warning. Option A is incorrect - storing the forward trust certificate on an HSM is a recommended security practice. Option B is incorrect because the Forward Untrust cert should be untrusted. Option C is incorrect - you configure Forward Trust and Forward Untrust certificates separately, not by checking both boxes on a single certificate.

No community discussion yet for this question.