A security engineer must deploy X 509 certificates to two web servers behind a load balancer. Each web server is configured identically. Which of the following should be done to ensure certificate name mismatch errors do not occur?
A.
Create two certificates, each with the same fully qualified domain name, and associate each with the web servers’ real IP addresses on the load balancer.
B.
Create one certificate on the load balancer and associate the site with the web servers’ real IP addresses.
C.
Create two certificates, each with the same fully qualified domain name, and associate each with a corresponding web server behind the load balancer.
D.
Create one certificate and export it to each web server behind the load balancer.
I've worked with certs and load balancers for years and the ideal solution is to place the cert on the load balancer to do SSL offload, then pass unencrypted traffic to the webservers on the back end. However that's not an option here.
Of the bunch of answers the best solution is D. One cert deployed on multiple webservers so that the load balancer passes the traffic straight through with no SSL offload on the LB There's absolutely no need to create one cert for each webserver, that would be really expensive an a nightmare from a cert management perspective doing that for every single load balanced FQDN. Imagine having to manage multiple certs for one FQDN all expiring at different times.
The only time you would create multiple certs with the same FQDN is if they were going to be used by a different webserver groups in different geographical locations. That way if the cert was compromised in one location it's easy to revoke and replace.
I'm 100% going for D on this one!
D.
When you have multiple web servers behind a load balancer, the common approach is to use a single SSL/TLS certificate that is shared among all servers. This ensures that the certificate presented to the clients is consistent regardless of which server handles the request. This setup avoids certificate name mismatch errors because all servers will present the same certificate, which matches the fully qualified domain name (FQDN) of the website.
D. Create one certificate and export it to each web server behind the load balancer.
This is generally the best approach when you have multiple identical web servers behind a load balancer. By using the same certificate, you ensure that no matter which server handles a given request, the certificate will match the domain name the client is expecting.
You don't need a wildcard certificate, you just create a new certificate with one subject alternative name, then specify that FQDN on the certificate. If the webserver hosts multiple FQDN names, then specify all of them on the certificate or use wildcard, but its not a requirement to use wildcard, it just makes things easier. Answer in this case is D.
To ensure certificate name mismatch errors do not occur, the engineer should create one certificate on the load balancer and associate the site with the web servers' real IP addresses (B).
When a client requests a website that is load-balanced across multiple servers, the load balancer is responsible for directing the request to one of the servers. Each server must present the same certificate to the client to prevent certificate name mismatch errors. In this scenario, using a single certificate that is associated with the real IP addresses of the web servers on the load balancer will ensure that the same certificate is presented to the client no matter which server handles the request.
The best option to ensure certificate name mismatch errors do not occur is to create two certificates, each with the same fully qualified domain name, and associate each with a corresponding web server behind the load balancer (option C). This way, each web server will have its own certificate with the correct name, and there will not be any issues with the load balancer trying to use the same certificate for both web servers.
A cert isn't associated with any webserver at any point. If you were to create a CER (Certificate Signing Request) for SAN name test.company.com and send it off to a CA like entrust they simply sign it and return it to you. The PFX for test.company.com can then be deployed on any webserver as many times as needed.
The CA would never sign a cert for you if you attempted to associate the cert with some random internal webserver IP in a 10.0.0.X range as its not a valid FQDN and you don't own the IP.
Correct me if I'm wrong, but I think it's A - Create two certificates, each with the same FQDN, and associate each with a corresponding web server behind the load balancer. This will ensure that each server presents a valid certificate with the correct FQDN, and that the client is able to establish a secure connection without any errors. A, B, and D will not work, because they do not provide a valid certificate with the correct FQDN for each web server behind the load balancer.
If the load balancer hosts a site test.company.com and the webservers behind the LB all return the same cert with the SAN name "test.company.com". Why would that be invalid to the user?
Found this
You should be able to use the same certificate on each server. If your web site is www.gathright.com, you should be able to buy a cert for that FQDN. Then you install it on each of your 5 servers behind the balancer.
Source: https://serverfault.com/questions/68753/does-each-server-behind-a-load-balancer-need-their-own-ssl-certificate
C may be correct.
Using this link he agrees the answer is D - "If you do your load balancing on the TCP or IP layer (OSI layer 4/3, a.k.a L4, L3), then yes, all HTTP servers will need to have the SSL certificate installed."
It can be D also. Your argument is that you'll be able to use one certificate, but you chose creating two certificates instead. D should be ok
upvoted 2 times
...
...
This section is not available anymore. Please use the main Exam Page.CS0-002 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
SimonR2
Highly Voted 1 year, 9 months agozecomeia_007
Most Recent 10 months, 4 weeks agochaddman
1 year, 6 months agoreidsel
1 year, 11 months agodb97
2 years, 2 months ago2Fish
2 years, 1 month agoSimonR2
1 year, 9 months agoms200
2 years, 3 months agoTIM0088
2 years, 4 months agoSimonR2
1 year, 9 months agobob12356
2 years, 4 months agobob12356
2 years, 4 months agoSimonR2
1 year, 9 months agomarc4354345
2 years, 4 months agoComptia_Secret_Service
2 years, 5 months agoSimonR2
1 year, 9 months agoiking
2 years, 4 months ago