Question

Difficulty: MediumPassword Security Policies, MFA, and Certificates

A network administrator installs a new identity certificate on a Cisco IOS router to secure HTTPS management access. However, when administrative workstations attempt to connect to the router via HTTPS, their web browsers display a security warning stating that the certificate issuer is untrusted. The router's system clock is synchronized via NTP, and the certificate is within its valid date range. What is the root cause of this trust failure?

  1. The client workstations lack the root certificate of the issuing Certificate Authority in their trusted certificate store to validate the chain of trust.Answer
  2. B
    The client workstations must obtain the router's private key to decrypt and verify the digital signature on the router's identity certificate.
  3. C
    The router failed to generate a new Certificate Signing Request during the active TLS handshake negotiation.
  4. D
    The administrator must save the running configuration to retain the dynamically generated sticky MAC address associated with the PKI trustpoint.

Answer

The client workstations lack the root certificate of the issuing Certificate Authority in their trusted certificate store to validate the chain of trust.
For a client browser to trust a server's identity certificate, it must validate the certificate signature using the public key of the issuing Certificate Authority (CA). If the CA root certificate (or intermediate CA certificate) is missing from the client's trusted root certificate store, the browser cannot build a valid chain of trust and will display an untrusted certificate warning.

Step-by-Step Solution

1
Analyze the certificate validation failure symptom
Client browsers reject the router's identity certificate due to an untrusted issuer.
During a TLS handshake, the client verifies the digital signature on the server's certificate against known, trusted Certificate Authorities.
2
Evaluate PKI trust requirements
The client must possess the public key (root certificate) of the CA that signed the identity certificate.
Without the root CA certificate installed in the client's local trusted root store, the browser cannot build a valid chain of trust back to a trusted anchor.

Key Concept

Public Key Infrastructure Chain of Trust and Root CA Certificate Validation
Rate this question