Examkin

Question

Difficulty: EasyPublic Key Infrastructure and Certificate Management

A security technician is configuring a web application server that hosts multiple distinct domain names on a single IP address. During initial testing, users receive a certificate domain name mismatch warning when attempting to navigate to the secondary domain. Which of the following X.509 certificate fields or extensions must be configured in the Certificate Signing Request (CSR) to resolve this warning?

  1. Subject Alternative Name (SAN)Answer
  2. B
    Online Certificate Status Protocol (OCSP) stapling
  3. C
    Non-repudiation key usage flag
  4. D
    Symmetric session key exchange parameters

Answer

The Subject Alternative Name (SAN) extension must be configured in the Certificate Signing Request (CSR).
Subject Alternative Name (SAN) is an X.509 certificate extension that allows a single certificate to secure multiple hostnames, domain names, or IP addresses. Specifying all intended hostnames in the SAN extension during CSR generation ensures client browsers successfully match the requested domain to the certificate identity.

Step-by-Step Solution

1
Identify the cause of the TLS certificate mismatch warning
The client browser rejects the connection because the domain requested by the client does not match the subject name on the presented X.509 certificate.
Browsers validate server identity by ensuring the requested URL matches a listed domain identity within the server's certificate attributes.
2
Determine the appropriate certificate field for securing multiple domain names
The Subject Alternative Name (SAN) extension allows an administrator to list additional hostnames, FQDNs, or IP addresses under a single certificate.
Populating the SAN field during CSR creation instructs the Certificate Authority (CA) to issue a multi-domain certificate valid for all specified domains.

Key Concept

Subject Alternative Name (SAN) extension in Public Key Infrastructure
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic