200-201 Question 159
Select 4An organization is implementing HTTPS on their web servers to ensure secure communication with clients. However, during testing, users report receiving a browser warning stating 'Certificate not trusted.' Which of the following could be potential causes of this issue?
- A
The certificate was issued by an untrusted Certificate Authority (CA).
- B
The certificate is self-signed and not from a trusted third-party CA.
- C
The public key in the certificate is being used for encryption instead of the private key.
- D
The certificate has expired or is not yet valid.
- E
The certificate's CA root certificate is not included in the browser's trusted store.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Certificates play a critical role in establishing trust during secure communications. HTTPS relies on a valid certificate issued by a trusted CA. If the certificate is not from a trusted source, expired, or the CA's root is missing from the browser's trusted store, users will encounter warnings. Self-signed certificates also bypass the trusted CA system, leading to trust issues unless explicitly configured.
- A. Correct.
If the certificate was issued by a CA that is not trusted by the browser, the warning will be displayed. Trusted CAs are preloaded in browser trust stores.
- B. Correct.
Self-signed certificates are not inherently trusted by browsers unless explicitly added to the trust store, leading to warnings.
- C. Incorrect.
This option is incorrect because the key usage (encryption or decryption) does not affect trust. The issue is related to the certificate's trust chain.
- D. Correct.
If the certificate is expired or its validity period has not started, browsers will warn users that it cannot be trusted.
- E. Correct.
If the browser cannot find the CA's root certificate in its trusted store, the chain of trust is broken, and the certificate is flagged as untrusted.