A network administrator is establishing PKI certificate management processes and automated revocation checks for a cluster of internal web applications. To ensure optimal security during certificate issuance and minimize handshake latency during revocation checking, which of the following implementation steps should the administrator select? (Select TWO).
- Generate the private key locally on the target web server when creating the Certificate Signing Request (CSR) before submitting it to the Certificate Authority.Cevap
- Configure OCSP stapling on the web servers so that cached, digitally signed CA revocation responses are delivered directly to client browsers during the TLS handshake.Cevap
- CDistribute the private key of the root Certificate Authority to client devices so they can sign their own CSR submissions locally.
- DUtilize asymmetric public key encryption for bulk session payload data transfer across established TLS channels to increase processing speed.
- EEmbed digital signatures using the client's public key to guarantee non-repudiation and data origin authenticity for server responses.
Cevap
The correct implementation steps are local private key generation during CSR creation and configuring OCSP stapling on web servers.
Generating the private key locally when creating a CSR ensures the private key is never exposed across the network. Enabling OCSP stapling allows the web server to append signed revocation proof directly during the TLS handshake, reducing latency and avoiding client connection delays.
Adım Adım Çözüm
Anahtar Kavram
PKI Certificate Request Flow and OCSP Stapling Revocation Verification