A security administrator needs to obtain and deploy a new TLS server certificate signed by a public Certificate Authority (CA). What is the correct sequence of administrative steps to accomplish this task?
- 1Generate an asymmetric key pair (private key and public key) locally on the web server.
- 2Create a Certificate Signing Request (CSR) incorporating the public key and domain identification details.
- 3Submit the CSR to the Certificate Authority (CA) for identity validation and digital signing.
- 4Install the CA-signed digital certificate onto the web server to enable secure HTTPS communication.
Answer
The correct sequence is: 1) Generate an asymmetric key pair locally on the server; 2) Create a Certificate Signing Request (CSR) containing the public key and domain details; 3) Submit the CSR to the Certificate Authority (CA) for validation and signing; 4) Install the CA-signed digital certificate on the web server.
The standardized PKI certificate enrollment workflow requires local key pair generation first, followed by bundling the public key into a CSR, submitting the CSR to the CA for domain verification and signature, and finally binding the issued certificate to the web service.
Step-by-Step Solution
Key Concept
PKI Certificate Request and Enrollment Lifecycle Workflow