Examkin

Question

Difficulty: Very hardPublic Key Infrastructure and Certificate Management

A security operations team is deploying internal code-signing certificates generated through an enterprise two-tier PKI consisting of an offline root Certificate Authority (CA) and an online intermediate issuing CA. Developers submit Certificate Signing Requests (CSRs) for binary signing. During testing on isolated target systems that already have the offline root CA certificate installed in their trusted root store, verification fails because the operating system cannot build the certification path to validate the signature. Further inspection reveals that the intermediate CA certificate was neither bundled with the signature nor pre-installed on the target machines. Which of the following is the most appropriate action to resolve this certificate chain validation failure?

  1. Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.Answer
  2. B
    Generate a new Certificate Signing Request (CSR) directly from the offline root CA to sign end-entity binaries, bypassing the intermediate CA.
  3. C
    Re-encrypt the executable binaries with the root CA's symmetric pre-shared key prior to distributing them to target systems.
  4. D
    Embed a SHA-256 hash manifest into the binary header to replace the digital signature and establish non-repudiation.

Answer

Configure the AIA (Authority Information Access) extension in issued certificates to provide a reachable URI for the intermediate CA certificate.
Configuring the AIA (Authority Information Access) extension allows validating client software to fetch the missing intermediate CA certificate via HTTP or LDAP during path building. This enables the client to successfully construct and verify the full certificate chain from the end-entity code-signing certificate up to the offline root CA.

Step-by-Step Solution

1
Identify the cause of the trust chain validation failure.
Client systems have the offline root CA trusted, but cannot build the validation path because the intermediate CA certificate is missing.
PKI certificate validation requires a complete chain of trust from the end-entity certificate up through all intermediate CAs to an installed root CA.
2
Evaluate standard PKI mechanisms for resolving missing intermediate certificates.
The Authority Information Access (AIA) extension specifies pointers (URIs) where clients can dynamically retrieve intermediate CA certificates during path building.
Including the AIA extension enables automated certificate discovery and path construction without manual distribution of intermediate certificates to all endpoints.
3
Select the proper administrative resolution.
Configuring the AIA extension ensures clients can fetch the intermediate certificate and complete path building successfully.
This maintains the multi-tier hierarchy and offline status of the root CA while ensuring seamless signature validation.

Key Concept

Public Key Infrastructure (PKI) Certificate Chain Building and Authority Information Access (AIA)
Estimated Time:2m 0s
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic