200-201 Question 167
Select 3A cybersecurity analyst is investigating a security incident involving a compromised internal web server. Upon examining the HTTPS configuration, the analyst discovers that the X.509 certificate used by the server has expired. Which of the following are likely impacts of using an expired X.509 certificate?
- A
Clients may receive warnings indicating the connection is not secure.
- B
The server’s encrypted communication with clients will completely stop.
- C
Attackers could impersonate the server more easily in a man-in-the-middle attack.
- D
The certificate will no longer be trusted by most browsers or operating systems.
- E
The server will automatically switch to an alternative valid certificate.
Show answer and explanation
Correct answers: A, C, D
Explanation
An expired X.509 certificate can lead to significant security and usability issues. It causes client-side warnings, reduces trust in the server, and increases the risk of impersonation attacks. However, it does not stop encrypted communication entirely, and servers must be manually reconfigured to use a new or alternative certificate.
- A. Correct.
Correct: When an X.509 certificate expires, clients such as web browsers display warnings to users, indicating the connection is not secure. This could discourage users from proceeding.
- B. Incorrect.
Incorrect: While the certificate has expired, the encrypted communication (TLS/SSL) can still function. However, the trustworthiness of the connection is compromised.
- C. Correct.
Correct: An expired certificate weakens security, making it easier for attackers to perform man-in-the-middle attacks by impersonating the server.
- D. Correct.
Correct: Expired certificates are no longer trusted by most browsers or operating systems, affecting the server's reputation and client trust.
- E. Incorrect.
Incorrect: Servers do not automatically switch to alternative certificates without being explicitly configured to do so.