English
Menu

Information Security Basics

It has been discovered that the private key corresponding to a web server's server certificate may have been leaked. The certificate has not yet expired. What is the most appropriate action for the operator?

  1. AKeep using the current certificate and private key until the certificate expires
  2. BKeep the certificate's public key secret and stop distributing it to users
  3. CAsk the certificate authority (CA) to revoke the certificate and have a certificate issued again for a new key pair
Show answer and explanation

Answer: C. Ask the certificate authority (CA) to revoke the certificate and have a certificate issued again for a new key pair

A certificate is a statement that "this public key belongs to this domain name (or organization)," signed by a certificate authority (CA). By following the signatures back to a CA they trust, users can trust who owns a public key. This mechanism of guaranteeing public-key ownership with CAs and certificates is called PKI (public key infrastructure). If a private key is leaked, an attacker can impersonate the genuine server or forge signatures. A certificate remains valid until it expires, so without waiting, the operator asks the CA to revoke it and have it published as invalid. Users can check revocation status through CRLs (certificate revocation lists) or OCSP. The operator then has a new certificate issued for a newly generated key pair. Public keys are meant to be public, and keeping one secret does not stop misuse of a leaked private key.

  • A. Attackers could keep impersonating the genuine server with the leaked private key. The certificate must be revoked without waiting for it to expire.
  • B. Public keys are meant to be public. Keeping it secret does not prevent misuse of the leaked private key.
  • C. Correct. Revoking the certificate prevents misuse, and a certificate is obtained again for a new key pair.
Practice this topic Back to topic

Related calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. Of the three factors of authentication used to verify a user (knowledge, possession and inherence), which one applies to authentication with an employee ID smart card?
  2. Which of the following authentication methods is multi-factor authentication?
  3. In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?
  4. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?
  5. Which statement correctly describes single sign-on (SSO)?