A client has accessed an HTTPS server at myhost1.example.com using Chrome. The server sends a certificate that includes these properties: Subject name: myhost.example.com SAN: DNS: myhost.example.com; DNS: myhost1.example.com Extended Key Usage (EKU): Server authentication Issuer: MyCA_Signing The server also sends an intermediate CA certificate for MyCA_Signing, which is signed by MyC

The process of validating a digital certificate requires establishing a chain of trust from the server's certificate to a trusted root Certificate Authority (CA) in the client's trust store. The scenario describes a certificate chain: Server -> MyCASigning (Intermediate) -> MyCA (Root). The client cannot trust the server's certificate because the root of this chain, MyCA, is not in its list of trusted CAs. Without a trusted root, the entire chain is considered untrusted, leading to a security warning in the browser. The other certificate properties like SAN and EKU are correctly configured for this use case.

B. The certificate's Subject Alternative Name (SAN) list includes DNS:myhost1.example.com, which correctly matches the hostname the client is accessing.
C. The Extended Key Usage (EKU) is set to "Server authentication," which is the correct value for an HTTPS server certificate.
D. This option is incorrect because, while the client lacks the correct trusted CA, the certificate does possess a valid SAN.

1. Internet Engineering Task Force (IETF). RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. May 2008. Section 6.1, "Basic Path Validation," states that a valid path must terminate with a trust anchor (a trusted CA).

2. Aruba Networks. (2021). ArubaOS 8.6.0.x User Guide. "Certificates," page 1034. The guide explains that for a client to trust a controller's webUI certificate, the certificate's entire chain must be trusted, which requires the root CA to be in the client's trust store.