Examkin

Question

Difficulty: EasyPublic Key Infrastructure and Certificate Management

A network administrator is setting up a new secure web server and needs to obtain an X.509 digital certificate from an enterprise Certificate Authority (CA). Which of the following actions should the administrator perform first on the server?

  1. Generate a private key and create a Certificate Signing Request (CSR)Answer
  2. B
    Install the CA root certificate into the web server's local trust store before key creation
  3. C
    Export the server's symmetric key to send to the Certificate Authority for signing
  4. D
    Compute a cryptographic hash of the web content to establish non-repudiation with the CA

Answer

The administrator must first generate a key pair and create a Certificate Signing Request (CSR) on the web server.
Generating a private key and creating a Certificate Signing Request (CSR) is the first standard step in obtaining an SSL/TLS certificate. The CSR contains the server's public key along with identifying information (such as domain name and organization) which is sent to the Certificate Authority for validation and signing.

Step-by-Step Solution

1
Identify the initial phase of PKI certificate enrollment.
The server needs to generate an asymmetric key pair (public and private keys).
The private key stays securely on the server, while the public key must be packaged for the Certificate Authority.
2
Package the public key with identifying details.
A Certificate Signing Request (CSR) is generated.
The CSR includes identity information (such as Common Name/SAN) and the public key, which the CA signs to produce the digital certificate.

Key Concept

PKI Certificate Request Workflow
Rate this question

Topics

Public Key Infrastructure and Certificate Management

More questions from this topic