200-201 Question 166
Single answerA cybersecurity analyst is investigating a secure web server's X.509 certificate after users reported browser warnings when visiting the site. Upon examining the certificate, the analyst discovers that it is not trusted by the browser. Which of the following is the most likely reason for this issue?
- A
The certificate has expired.
- B
The certificate was signed by an untrusted Certificate Authority (CA).
- C
The certificate's Common Name (CN) does not match the server's domain name.
- D
The certificate uses an outdated encryption algorithm.
Show answer and explanation
Correct answer: B
Explanation
The trustworthiness of an X.509 certificate in a browser relies on it being signed by a trusted Certificate Authority (CA). If the certificate is issued by an untrusted or unknown CA, the browser will flag it as untrusted, triggering warnings for users. This is a common issue when organizations use self-signed certificates or a CA that is not in the browser's trusted CA list.
- A. Incorrect.
An expired certificate would cause a different type of warning related to the validity period, but the question specifies a trust issue with the browser.
- B. Correct.
If the certificate was signed by an untrusted Certificate Authority (CA), the browser will not trust the certificate, leading to warnings. This is the most likely reason in this scenario.
- C. Incorrect.
A mismatch between the certificate's Common Name (CN) and the server's domain name would result in a warning about the domain mismatch, not necessarily a trust issue.
- D. Incorrect.
While outdated encryption algorithms can raise security concerns, they would not typically result in a trust warning from the browser.