Examkin

Question

Difficulty: MediumPublic Key Infrastructure and Certificate Management

An organization observes significant latency during TLS handshakes because client browsers independently query an external Certificate Authority (CA) to check revocation status. Additionally, the privacy team raises concerns that direct client queries allow the CA to monitor user browsing activity. Which of the following features should the security administrator configure on the web server to reduce latency and address the privacy concern?

  1. Enable OCSP stapling on the web server so it periodically fetches signed status responses and appends them to the TLS handshake.Answer
  2. B
    Require clients to download the full Certificate Revocation List (CRL) before generating a new Certificate Signing Request (CSR).
  3. C
    Configure the web server to use symmetric encryption algorithms to digitally sign the certificate status response sent to clients.
  4. D
    Replace the server certificate with a shared symmetric hash to ensure non-repudiation during certificate status validation.

Answer

Enable OCSP stapling on the web server so it periodically fetches signed status responses and appends them to the TLS handshake.
Online Certificate Status Protocol (OCSP) stapling allows the web server to query the CA's OCSP responder at regular intervals, cache the time-stamped signed response, and staple it directly to the TLS handshake. This eliminates client-side round-trip delays and prevents the CA from tracking client IP addresses.

Step-by-Step Solution

1
Analyze performance and privacy constraints in certificate status checking
Identified direct client-to-CA OCSP queries as the root cause of latency and IP tracking concerns.
Client-initiated OCSP checks introduce additional round-trip times and expose user browsing destinations to the CA.
2
Evaluate PKI revocation optimization techniques
Selected OCSP stapling as the solution that shifts responder querying to the web server.
The server retrieves a signed, time-stamped OCSP response in advance and attaches (staples) it to the initial TLS handshake.
3
Confirm resolution of requirements
Verified that clients no longer contact the CA directly, eliminating extra latency and protecting client IP privacy.
Clients receive validated revocation status directly from the server during handshake setup.

Key Concept

Online Certificate Status Protocol (OCSP) Stapling
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic