Which statement about generating a certificate signing request (CSR) for a CER certificate is true?

The information contained within a Certificate Signing Request (CSR) is critical for the Certificate Authority's (CA) validation process. The CA's role is to verify that the entity requesting the certificate is who they claim to be and, for domain-validated certificates, that they control the specified domain. Fields such as Common Name (CN), Organization (O), and Locality (L) must be accurate. If the CA's validation process finds discrepancies or missing information, it cannot confirm the requester's identity or authority. As a result, the request will be rejected, and the certificate will not be issued, leading to necessary corrections and resubmissions, which cause delays.

B: A CA will not knowingly issue a certificate with incorrect key fields, as this would violate the trust model and validation requirements they must adhere to.

C: CSR fields define the public identity of the certificate's subject for relying parties to verify, not just for internal recordkeeping by the requester.

D: CAs are responsible for validating, not correcting, the information provided in a CSR. An incorrect submission must be fixed and resubmitted by the applicant.

1. FortiOS 7.6.0 Administration Guide: In the "Certificates" chapter, under the procedure for generating a CSR, the guide specifies the required fields (Common Name, Organization, etc.) and notes, "The information you enter when generating the CSR must be accurate and match your organization's legal information, as the CA will verify it." This implies that failure to provide accurate information will lead to verification failure. (Reference: FortiOS Administration Guide 7.6, Certificates > Generate a CSR).

2. CA/Browser Forum Baseline Requirements: This is the industry standard governing the issuance of publicly trusted certificates. Section 3.2, "Validation of Domain Authorization or Control," and its subsections detail the rigorous verification CAs must perform on the applicant's information provided in the CSR. A failure in this validation process due to inaccurate data prevents certificate issuance. (Reference: CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, Version 2.0.2, Section 3.2).