A security administrator is configuring digital certificates for an enterprise web gateway that host services for multiple subdomains across different domain names. To optimize TLS handshake performance, maintain client privacy, and ensure multi-domain validity, which TWO of the following configurations or steps should the administrator implement? (Select TWO.)
- Request a digital certificate that includes the Subject Alternative Name (SAN) extension containing all relevant fully qualified domain names.Cevap
- BInclude the server private key within the Certificate Signing Request (CSR) submitted to the Certificate Authority for validation.
- Enable OCSP stapling on the web gateway so the server appends a time-stamped CA revocation response directly during the TLS handshake.Cevap
- DGenerate a symmetric key pair during the CSR creation process to sign the digital certificate extensions.
- ESubstitute digital signatures with symmetric message authentication codes (MACs) to guarantee non-repudiation across all issued certificates.
Cevap
The correct configurations are requesting a digital certificate with the Subject Alternative Name (SAN) extension for multi-domain support and enabling OCSP stapling on the gateway to improve performance and client privacy.
The Subject Alternative Name (SAN) extension permits a single X.509 certificate to secure multiple hostnames and subdomains across distinct domain names. Concurrently, OCSP stapling allows the web gateway to periodically fetch a signed OCSP response from the CA and staple it to the TLS handshake, which eliminates client-side OCSP queries, decreases handshake latency, and protects user browsing privacy.
Adım Adım Çözüm
Anahtar Kavram
Public Key Infrastructure, Subject Alternative Name (SAN) extensions, and OCSP Stapling