300-415 Question 228
Single answerAn organization has deployed Cisco SD-WAN and is using SSL/TLS proxy to inspect encrypted traffic between branch sites and external web servers. During configuration, the administrator notices that certain applications are failing to connect when SSL/TLS proxy is enabled. What is the most likely cause of this issue?
- A
The SSL/TLS proxy is configured with an unsupported cipher suite.
- B
The certificate used by the SSL/TLS proxy is not trusted by the client devices.
- C
The SD-WAN edge device does not have sufficient compute resources to handle SSL/TLS decryption.
- D
The SSL/TLS proxy is incorrectly configured with a wildcard certificate.
Show answer and explanation
Correct answer: B
Explanation
The SSL/TLS proxy functions by intercepting and decrypting SSL/TLS traffic, which requires presenting a trusted certificate to client devices. If the certificate is not trusted (e.g., not signed by a recognized Certificate Authority or not distributed to client devices), clients will reject the connection, causing application failures. Ensuring that the SSL/TLS proxy's certificate is trusted by client devices is critical for successful operation.
- A. Incorrect.
While an unsupported cipher suite could cause issues, it is less likely to result in application connection failures across multiple services. This issue would typically manifest as specific encryption negotiation failures.
- B. Correct.
If the certificate presented by the SSL/TLS proxy is not trusted by client devices, the clients will reject the connection, leading to application failures. This is a common cause of SSL/TLS proxy issues.
- C. Incorrect.
While insufficient compute resources could degrade performance, it is unlikely to directly cause application connection failures. Performance issues would typically manifest as latency or dropped traffic rather than complete failures.
- D. Incorrect.
An incorrectly configured wildcard certificate could cause certificate validation issues, but it is less likely to be the root cause than an untrusted certificate because wildcard certificates are commonly used and generally accepted when properly configured.