An organization deploys a new RADIUS server to support 802.1X EAP-TLS authentication across corporate laptops. During testing, client devices fail to authenticate, reporting that the RADIUS server's identity cannot be verified. Analysis indicates that while client devices trust the organization's offline Root CA, the RADIUS server is transmitting only its leaf certificate, and clients cannot validate the intermediate issuing CA that signed it. Which of the following configuration changes on the server will resolve the authentication failure?
- Bundle the intermediate issuing CA certificate with the server certificate so the complete trust chain is provided during the TLS handshake.Cevap
- BGenerate a new Certificate Signing Request (CSR) directly against the Root CA to bypass intermediate validation steps.
- CReconfigure the server certificate payload to use symmetric key exchange instead of asymmetric public keys.
- DEnable the digital signature key usage extension on the server certificate to enforce non-repudiation during handshake renegotiation.
Cevap
The server must be configured to supply the intermediate issuing CA certificate in a bundle with its server certificate to complete the certificate trust chain during the TLS handshake.
Supplying the intermediate issuing CA certificate alongside the server's leaf certificate provides the client with the full certificate chain. This allows the client to build a valid trust path from the server certificate up to the locally trusted Root CA.
Adım Adım Çözüm
Anahtar Kavram
Certificate Chaining and Trust Path Validation
Tahmini Süre:1m 30s