Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

An enterprise systems specialist is configuring an automated build server to sign software packages using a newly established internal Public Key Infrastructure (PKI). Before requesting a digital certificate from the enterprise Certificate Authority (CA), the specialist must prepare a Certificate Signing Request (CSR) on the build server. Which of the following operations occurs on the build server prior to transmitting the CSR to the CA?

  1. Generating an asymmetric key pair locally and embedding the public key into the request while retaining the private key securely on the serverAnswer
  2. B
    Exporting the locally generated private key alongside the public key within the CSR payload so the CA can sign both keys
  3. C
    Generating a bulk symmetric encryption key and including it in the request to secure the payload during transit
  4. D
    Hashing the request details with a shared symmetric secret to establish non-repudiation with the CA before key creation

Answer

Generating an asymmetric key pair locally and embedding the public key into the request while retaining the private key securely on the server
Generating an asymmetric key pair locally and embedding the public key into the CSR is the foundational step in PKI certificate request workflows. The private key remains stored securely on the requesting system and is never transmitted over the network or sent to the Certificate Authority.

Step-by-Step Solution

1
Identify the standard workflow for generating a Certificate Signing Request (CSR) in a Public Key Infrastructure (PKI).
The applicant system initiates asymmetric key generation locally.
The security of asymmetric cryptography depends on the private key remaining strictly under the control of the local host.
2
Determine which component of the asymmetric key pair is submitted to the Certificate Authority (CA).
The public key, along with subject identity information, is encoded into the CSR format.
The CA signs the public key to bind the identity to that specific public key via an issued X.509 certificate.

Key Concept

CSR Generation and Asymmetric Key Lifecycle
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic