Examkin

Soru

Zorluk: OrtaPublic Key Infrastructure and Certificate Management

An enterprise security administrator is deploying a high-traffic public web application server using TLS encryption. To minimize TLS handshake latency and prevent third-party tracking of user browsing habits caused by real-time client queries to an external Certificate Authority (CA), the administrator wants the web server to fetch and cache signed revocation status responses from the CA to append during the TLS handshake. Which of the following solutions should the administrator implement?

  1. OCSP staplingCevap
  2. B
    Submitting the server's private key along with the Certificate Signing Request (CSR) to the CA
  3. C
    Configuring key escrow to guarantee non-repudiation of client web session requests
  4. D
    Embedding a shared symmetric key within the Subject Alternative Name (SAN) certificate extension

Cevap

Implementing OCSP stapling satisfies the requirement by allowing the web server to cache a signed status response from the Certificate Authority and present it directly to the client during the TLS handshake.
OCSP stapling delegates the task of obtaining a signed time-stamped certificate status response to the web server itself. The server regularly polls the OCSP responder and appends (staples) the signed response directly to the TLS handshake payload. This eliminates the privacy issue of clients contacting the CA directly and avoids latency overhead during connection establishment.

Adım Adım Çözüm

1
Identify the performance and privacy challenge in the scenario
Direct client queries to an Online Certificate Status Protocol (OCSP) responder leak user browsing activity to the CA and add network latency to every TLS connection establishment.
Traditional OCSP checking forces every web client to make an out-of-band request to the CA prior to trusting the server's certificate.
2
Evaluate PKI mechanisms designed to offload revocation checking to the web server
OCSP stapling (Certificate Status Request extension) enables the web server to query the CA's OCSP responder at regular intervals, cache the digitally signed OCSP response, and staple it to the TLS Certificate Status message during the client handshake.
This removes the need for the client to contact the CA directly, safeguarding client privacy and eliminating extra DNS and HTTP request delays.

Anahtar Kavram

Online Certificate Status Protocol (OCSP) Stapling
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Public Key Infrastructure and Certificate Management

Bu konudan daha fazla soru