A network administrator installs a new identity certificate on a Cisco IOS router to secure HTTPS management access. However, when administrative workstations attempt to connect to the router via HTTPS, their web browsers display a security warning stating that the certificate issuer is untrusted. The router's system clock is synchronized via NTP, and the certificate is within its valid date range. What is the root cause of this trust failure?
- The client workstations lack the root certificate of the issuing Certificate Authority in their trusted certificate store to validate the chain of trust.Answer
- BThe client workstations must obtain the router's private key to decrypt and verify the digital signature on the router's identity certificate.
- CThe router failed to generate a new Certificate Signing Request during the active TLS handshake negotiation.
- DThe administrator must save the running configuration to retain the dynamically generated sticky MAC address associated with the PKI trustpoint.
Answer
The client workstations lack the root certificate of the issuing Certificate Authority in their trusted certificate store to validate the chain of trust.
For a client browser to trust a server's identity certificate, it must validate the certificate signature using the public key of the issuing Certificate Authority (CA). If the CA root certificate (or intermediate CA certificate) is missing from the client's trusted root certificate store, the browser cannot build a valid chain of trust and will display an untrusted certificate warning.
Step-by-Step Solution
Key Concept
Public Key Infrastructure Chain of Trust and Root CA Certificate Validation