Per organizational requirements, an administrator has uploaded a signed SSL certificate to Prism for Common Access Card (CAC) authentication. Once the certificate has been uploaded successfully, the certificate appears to be valid but CAC authentication is not functional. What is a potential cause of this problem?

For Common Access Card (CAC) or any smart card authentication to be functional in Nutanix Prism, the system must be able to verify that the client certificate has not been revoked. This is a mandatory security check. Prism uses either a Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP) for this purpose. If a valid SSL certificate is uploaded but the corresponding CRL is not configured, Prism has no way to check the certificate's revocation status. As a security measure, the authentication process will fail, leading to the exact symptoms described in the question.

B. RSA key size is incorrect. An incorrect or non-compliant RSA key size would likely cause the certificate to be rejected during the upload process or be flagged as invalid by the system.
C. Online Certificate Status Protocol (OCSP) is not enabled. This is an alternative revocation method to CRL. While its absence would also cause failure if it were the intended method, a missing CRL configuration is an equally direct and potential cause.
D. Signature Algorithm is incorrect. An unsupported signature algorithm would likely result in the certificate being considered invalid upon upload, which contradicts the scenario where it "appears to be valid."

1. Nutanix Prism Central Guide (pc-2024.1), Security Management > Configuring Authentication > Configuring Smart Card Authentication: "When you enable smart card authentication, you must also configure a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) service. Prism Central uses the CRL or OCSP service to check the revocation status of the smart card certificates." This statement confirms that configuring a revocation method like CRL is a required step.

2. Nutanix Security Guide (Version 6.5), Implementing Security Measures > Implementing CAC/Smartcard Authentication, page 63: "Nutanix supports two methods for checking certificate revocation status: Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP). You must configure one of these two methods for authentication to succeed." This explicitly states that one of the methods is mandatory for successful authentication.

3. Nutanix University, Nutanix Certified Professional (NCP) 6.5 Study Guide, Module 5: Security, Section: User Authentication: The courseware details the steps for configuring different authentication types, including smart cards. It emphasizes the requirement to configure a CA certificate chain and a corresponding revocation checking method (CRL or OCSP) for the authentication to be operational. The failure to configure the revocation check is a common reason for authentication failure.