Examkin

Question

Difficulty: HardPublic Key Infrastructure and Certificate Management

A security engineer is troubleshooting intermittent connection timeouts and handshake failures reported by users accessing a high-security internal web application. Network logs indicate that client web browsers are attempting to query external Certificate Authority (CA) validation servers to verify the revocation status of the application's TLS certificate. However, client endpoints are on a strict zero-trust VLAN with no outbound internet access, causing the certificate status requests to block and eventually time out. Which of the following should the security engineer implement on the web server to resolve the validation failures while maintaining certificate status checking?

  1. Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.Answer
  2. B
    Embed a Certificate Revocation List (CRL) distribution point directly into the Certificate Signing Request (CSR) before submitting it to the CA for signing.
  3. C
    Configure HTTP Public Key Pinning (HPKP) using a pre-shared symmetric encryption key header to bypass CA validation entirely.
  4. D
    Replace the certificate with a digital signature using HMAC hashing to guarantee non-repudiation without requiring CA verification.

Answer

Enable OCSP stapling on the web server so it periodically fetches and appends a time-stamped CA OCSP response during the TLS handshake.
Enabling OCSP stapling resolves client-side outbound connectivity issues by offloading OCSP status checks to the web server. The web server periodically contacts the CA's OCSP responder, receives a digitally signed and timestamped status response, and appends ('staples') this proof directly into the TLS handshake (Server Hello). This allows restricted internal clients to verify certificate validity without direct access to external CA servers.

Step-by-Step Solution

1
Analyze the root cause of the connection timeouts
Client browsers are trying to reach external CA infrastructure directly for Online Certificate Status Protocol (OCSP) or CRL verification, which fails because the client VLAN lacks outbound internet egress.
By default, clients perform revocation checks by contacting the CA's OCSP responder listed in the certificate's AIA extension.
2
Evaluate PKI mechanisms that allow revocation checking without client egress access
OCSP stapling (TLS Certificate Status Request extension) delegates the responsibility of querying the OCSP responder to the server itself.
The server queries the CA at configured intervals, caches the time-stamped signed OCSP assertion, and includes it directly in the initial TLS handshake to the client.
3
Verify requirement compliance
Client validation succeeds without requiring outbound client internet access, while maintaining security and resolving handshake latency.
The client receives proof of validity signed directly by the CA without making an independent network call.

Key Concept

OCSP Stapling (TLS Certificate Status Request Extension)
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic