Examkin

Question

Difficulty: Very hardPublic Key Infrastructure and Certificate Management

An enterprise security engineer is deploying S/MIME dual-key certificates (separate key pairs for digital signing and data encryption) across an organization using an internal PKI with key recovery capabilities. To comply with security governance, private encryption keys must be escrowed before certificate issuance, while signing keys must never be escrowed. Place the administrative operational steps in the correct chronological sequence from initial key pair creation to final client integration.

  1. 1Generate separate asymmetric key pairs on the client endpoint for digital signatures and email payload encryption.
  2. 2Securely back up and archive the private encryption key to the enterprise Key Escrow system while retaining the private signing key solely on the local system.
  3. 3Generate and submit a Certificate Signing Request (CSR) containing the client's public keys and identity attributes to the enterprise Intermediate Issuing CA.
  4. 4The Intermediate Issuing CA verifies the identity details, digitally signs the X.509 S/MIME certificate, and publishes it to the central LDAP directory.
  5. 5Import the signed X.509 certificate into the user's mail client certificate store and bind it to the local private keys.

Answer

The correct operational sequence begins with generating the dual key pairs on the endpoint, followed by archiving the private encryption key into key escrow, creating and transmitting the CSR to the Intermediate CA, the CA signing and publishing the X.509 S/MIME certificate, and finally importing the signed certificate into the user's email client store.
The proper sequence follows the cryptographic lifecycle: generating dual key pairs first provides the necessary key material. Next, the private encryption key must be safely backed up into key escrow before certification to ensure data recovery compliance while maintaining non-repudiation for the private signing key. After escrow verification, the client generates a CSR with public key material and sends it to the Issuing CA. The CA validates the identity, signs the X.509 certificate, and publishes it to the directory repository. Finally, the endpoint installs the signed certificate into the local email client store to enable cryptographic email functions.

Step-by-Step Solution

1
Initiate asymmetric key pair generation on the local workstation for S/MIME dual-key deployment.
Two distinct key pairs (signing key pair and encryption key pair) are generated.
Cryptographic material must exist before any submission, escrow, or signing actions can proceed.
2
Transmit the private encryption key to the enterprise Key Escrow database over an encrypted session, leaving the signing key strictly local.
The private encryption key is archived for enterprise data recovery compliance, while non-repudiation of digital signatures is preserved.
Enterprise PKI policy mandates that private key escrow occurs prior to CA certification so unbacked-up keys are never issued active certificates.
3
Formulate a Certificate Signing Request (CSR) including the public keys and subject distinguished name, then submit it to the Issuing CA.
The CA receives a structured CSR payload containing the identity details and public key material.
The CSR acts as the formal request for the CA to validate identity and certify public key ownership.
4
The Intermediate CA authenticates the request, signs the X.509 S/MIME certificate with its private key, and publishes the certificate to LDAP.
An authenticated, signed X.509 S/MIME certificate is created and published for enterprise access.
The CA is responsible for establishing trust by signing the public key and making the certificate accessible to other email users.
5
Download and install the issued X.509 certificate into the endpoint's personal certificate store.
The email client binds the signed certificate to the local private keys, completing S/MIME initialization.
The endpoint requires the signed certificate to complete TLS/MIME handshake routines and execute cryptographic operations.

Key Concept

S/MIME Dual-Key Lifecycle and Key Escrow Workflow
Estimated Time:3m 0s
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic