SY0-501 · Question #496
A company has two wireless networks utilizing captive portals. Some employees report getting a trust error in their browsers when connecting to one of the networks. Both captive portals are using…
The correct answer is B. Use certificate chaining. The trust error occurs because the browser cannot validate the server certificate due to an incomplete certificate path, as only the end-entity certificate is provided without its full chain of trust to a trusted root CA.
Question
A company has two wireless networks utilizing captive portals. Some employees report getting a trust error in their browsers when connecting to one of the networks. Both captive portals are using the same server certificate for authentication, but the analyst notices the following differences between the two certificate details:
Certificate 1 Certificate Path:
Geotrust Global CA *company.com Certificate 2 Certificate Path:
*company.com Which of the following would resolve the problem?
Options
- AUse a wildcard certificate.
- BUse certificate chaining.
- CUse a trust model.
- DUse an extended validation certificate.
How the community answered
(24 responses)- A4% (1)
- B75% (18)
- C13% (3)
- D8% (2)
Why each option
The trust error occurs because the browser cannot validate the server certificate due to an incomplete certificate path, as only the end-entity certificate is provided without its full chain of trust to a trusted root CA.
A wildcard certificate allows a single certificate to secure multiple subdomains but does not address the underlying problem of a missing intermediate certificate in the trust chain.
Certificate chaining ensures that all intermediate certificates, along with the end-entity certificate, are presented to the client. This allows the client's browser to build a complete trust path from the server certificate up to a trusted root Certificate Authority, resolving the trust error caused by an incomplete chain.
A trust model is a framework for establishing trust within a PKI, but simply using one does not automatically correct a specific technical configuration error like an incomplete certificate chain.
An Extended Validation (EV) certificate provides higher assurance and specific browser indicators but does not inherently solve issues with an incomplete or improperly presented certificate chain.
Concept tested: SSL/TLS certificate chain validation
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/certificate-chain-validation
Topics
Community Discussion
No community discussion yet for this question.