Examkin

Question

Difficulty: EasyPublic Key Infrastructure and Certificate Management

An organization wants to optimize web traffic performance and protect user privacy by reducing client requests to external Certificate Authorities for certificate status verification. Which of the following PKI mechanisms allows the web server itself to fetch and present a signed, timestamped certificate status directly to the client during the TLS handshake?

  1. OCSP staplingAnswer
  2. B
    Certificate signing request creation
  3. C
    Symmetric key negotiation
  4. D
    Digital signature non-repudiation logging

Answer

OCSP stapling allows the web server to query the CA and supply a timestamped validation response directly to the client during the TLS handshake.
OCSP stapling allows the web server to query the Online Certificate Status Protocol responder periodically, cache the timestamped signed response, and present it directly to the client during the TLS handshake. This reduces latency and prevents third-party CAs from tracking client IP addresses.

Step-by-Step Solution

1
Identify the performance and privacy requirement
Clients need to verify whether a server's X.509 certificate has been revoked without making distinct outbound HTTP queries to third-party CAs.
Direct client queries to an Online Certificate Status Protocol (OCSP) responder create connection latency and reveal user browsing behavior.
2
Select the PKI feature designed for server-side revocation caching
OCSP stapling offloads OCSP queries to the web server, which periodically retrieves the signed response and appends ('staples') it to the TLS handshake.
This allows clients to verify validity immediately during connection establishment.

Key Concept

OCSP Stapling
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic