[Content Security] Which two criteria must a certificate meet before the WSA uses it to decrypt application traffic? (Choose two.)

The WSA uses a root certificate and a private key to decrypt HTTPS traffic. The root certificate must

reside in the trusted store of the WSA, and it must be able to sign server certificates on the fly. The

server certificates that the WSA generates must contain a SAN (Subject Alternative Name) field,

which specifies the hostnames or IP addresses that the certificate is valid for. The SAN field is

required by modern browsers and applications to verify the identity of the server. If the WSA does

not include a SAN field in the server certificate, the browser or application may reject the connection

or display a warning message.

The other options are not correct because:

A . The current date is not a criterion for the WSA to use a certificate to decrypt application traffic.

The WSA checks the validity period of the certificate, which includes the start date and the end date.

The current date must be within the validity period, but it does not have to be the same as the start

date or the end date.

C . The root certificate that the WSA uses to decrypt HTTPS traffic does not have to reside in the

trusted store of the endpoint. However, the endpoint must trust the root certificate in order to

accept the server certificate that the WSA generates. This can be achieved by manually installing the

root certificate on the endpoint, or by using a group policy or a certificate management system to

distribute the root certificate to the endpoints.

D . The root certificate that the WSA uses to decrypt HTTPS traffic does not have to be signed by an

internal CA. The WSA can generate its own self-signed root certificate, or it can use a root certificate

that is signed by an external CA. However, the root certificate must be trusted by the endpoints, as

explained in option C.

Reference := : WSA Certificate Usage for HTTPS Decryption :

[User Guide for AsyncOS 12.0 for Cisco Web Security Appliances - GD (General Deployment) - Create

Decryption Policies to Control HTTPS Traffic]