Which action can be taken to immediately remediate the issue of application generating an alert UnknownCA from client?
A) Add the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption.
B) Enable certificate revocation checking to deny access to sites with revoked certificates.
C) Contact the site administrator with the expired certificate to request updates or renewal.
D) Check for expired certificates and take appropriate actions to block or allow access based on business needs.
Answer (2)
The most effective action to immediately resolve the 'UnknownCA' alert is to add the certificate Common Name (CN) to the SSL Decryption Exclusion List, allowing for traffic without decryption. This action prevents the application from evaluating the certificate against the unknown authority. While this is a temporary fix, it enables continued access to necessary resources while addressing underlying certificate issues.
;
The issue concerning the 'UnknownCA' alert indicates that the client does not recognize the Certificate Authority (CA) that issued the certificate for the application. This is a common issue with SSL/TLS connections when a server provides a certificate that the client cannot trace back to a trusted root. Here's how you can address this issue:
Add the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption (Option A).
This is the immediate remedial action when you encounter an 'UnknownCA' alert. By adding the certificate's Common Name (CN) to the SSL Decryption Exclusion List, you tell the system to bypass SSL decryption for traffic involving this certificate. This allows the traffic to proceed without interruption, even though the certificate is from an unknown or untrusted CA.
For example, if you are using a network security appliance such as a firewall, most have features or options where you can specify certain certificates or sites to be excluded from SSL decryption.
Why this approach works:
This action is advantageous because it allows you to quickly restore connectivity and functionality while you investigate the source of the certificate and determine whether full trust or other remediation steps are appropriate for the long-term.
Precautionary Measures:
While adding to the exclusion list addresses the immediate 'alert' situation, it's important to only use this as a temporary fix. Not performing decryption can expose you to potential security risks, so it's crucial to follow up with a full certification verification.
In summary, the immediate action to take when facing an 'UnknownCA' alert is to add the certificate CN to the SSL Decryption Exclusion List (Option A). This allows traffic to proceed while you further analyze why the certificate wasn't recognized and take longer-term corrective actions as necessary.
