An enterprise security policy requires software developers to digitally sign compiled binaries using a dedicated Hardware Security Module (HSM) USB token. Which of the following represents the correct sequential order of steps required to obtain and prepare the code signing certificate on the hardware token, from first to last?
- 1Generate an asymmetric key pair directly on the HSM USB token, ensuring the private key is marked as non-exportable.
- 2Generate a Certificate Signing Request (CSR) on the workstation using the public key from the HSM and subject identity details.
- 3Submit the CSR to the organization's trusted Certificate Authority (CA) for identity verification and digital signing.
- 4Import the signed public key certificate issued by the CA back onto the HSM token to bind it with the corresponding private key.
Cevap
The correct sequence begins with generating the asymmetric key pair on the HSM token, followed by generating the Certificate Signing Request (CSR), submitting the CSR to the Certificate Authority (CA) for signing, and finally importing the signed certificate onto the HSM token to bind it with the stored private key.
The standard PKI enrollment workflow follows a logical sequence. First, the asymmetric key pair must be generated directly on the target device (HSM) so the private key remains secure. Second, a CSR is built using the generated public key and subject metadata. Third, the CSR is submitted to the CA for verification and digital signature issuance. Finally, the resulting signed certificate is installed back onto the HSM to bind with the private key.
Adım Adım Çözüm
Anahtar Kavram
Public Key Infrastructure (PKI) Certificate Signing Request (CSR) and Hardware-Based Key Lifecycle