「証明書」ページのスクリーンショットを確認してください。 小規模 LLC の管理者は、計画された復号化ロールアウトに使用するために、次のような一連の証明書を作成しました。管理者は、すべてのクライアント システムに自己署名ルート証明書もインストールしました。 テスト中に、ユーザーが SSL サイトにアクセスするたびに、安全でない Web サイトの警告が表示されることに気づきました。 安全でない Web サイトの警告の原因は何ですか?
正解:D
Explanation The cause of the unsecured website warnings is that the forward trust certificate has not been signed by the self-signed root CA certificate. The forward trust certificate is used by the firewall to generate a copy of the server certificate for outbound SSL decryption (SSL Forward Proxy). The firewall signs the copy with the forward trust certificate and presents it to the client. The client then verifies the signature using the public key of the CA that issued the forward trust certificate. If the client does not trust the CA, it will display a warning message. Therefore, the forward trust certificate must be signed by a CA that is trusted by the client. In this case, the administrator has installed the self-signed root CA certificate in all client systems, so this CA should be used to sign the forward trust certificate. However, as shown in the screenshot, the forward trust certificate has a different issuer than the self-signed root CA certificate, which means it has not been signed by it. This causes the client to reject the signature and show a warning message. To fix this issue, the administrator should generate a new forward trust certificate and sign it with the self-signed root CA certificate12. References: Keys and Certificates for Decryption Policies, How to Configure SSL Decryption