Examkin

Soru

Zorluk: KolayPublic Key Infrastructure and Certificate Management

An organization wants to optimize web traffic performance and protect user privacy by reducing client requests to external Certificate Authorities for certificate status verification. Which of the following PKI mechanisms allows the web server itself to fetch and present a signed, timestamped certificate status directly to the client during the TLS handshake?

  1. OCSP staplingCevap
  2. B
    Certificate signing request creation
  3. C
    Symmetric key negotiation
  4. D
    Digital signature non-repudiation logging

Cevap

OCSP stapling allows the web server to query the CA and supply a timestamped validation response directly to the client during the TLS handshake.
OCSP stapling allows the web server to query the Online Certificate Status Protocol responder periodically, cache the timestamped signed response, and present it directly to the client during the TLS handshake. This reduces latency and prevents third-party CAs from tracking client IP addresses.

Adım Adım Çözüm

1
Identify the performance and privacy requirement
Clients need to verify whether a server's X.509 certificate has been revoked without making distinct outbound HTTP queries to third-party CAs.
Direct client queries to an Online Certificate Status Protocol (OCSP) responder create connection latency and reveal user browsing behavior.
2
Select the PKI feature designed for server-side revocation caching
OCSP stapling offloads OCSP queries to the web server, which periodically retrieves the signed response and appends ('staples') it to the TLS handshake.
This allows clients to verify validity immediately during connection establishment.

Anahtar Kavram

OCSP Stapling
Bu soruyu puanla

Konular

Public Key Infrastructure and Certificate Management

Bu konudan daha fazla soru