A network security administrator is commissioning a new internal web application server that requires a trusted SSL/TLS certificate signed by the enterprise internal Certificate Authority (CA). Which of the following sequences represents the correct chronological order of steps the administrator must perform to obtain and deploy this certificate?
- 1Generate a new asymmetric key pair locally on the target web server.
- 2Create a Certificate Signing Request (CSR) containing the public key and identity attributes such as the Subject Alternative Name (SAN).
- 3Submit the generated CSR to the internal Certificate Authority for validation and digital signature issuance.
- 4Install the issued public server certificate along with the intermediate CA certificate chain on the web server.
Answer
The correct operational sequence begins with generating the private/public key pair locally on the server, followed by creating the Certificate Signing Request (CSR) with identity details, submitting the CSR to the CA for verification and signing, and finally installing the signed certificate along with the intermediate CA trust chain on the server.
The proper PKI enrollment workflow begins by locally generating the asymmetric key pair on the web server to ensure private key protection. Next, a Certificate Signing Request (CSR) containing the public key and identity specifications (like SAN extensions) is created. This CSR is then submitted to the Certificate Authority (CA) for verification and signing. Finally, once signed, the certificate along with the intermediate CA certificates are installed on the server to enable valid TLS connections.
Step-by-Step Solution
Key Concept
Public Key Infrastructure Certificate Lifecycle and Request Workflow