This question is identical to Question 17, with the same certificate properties and scenario. The client (Chrome browser) accesses an HTTPS server at myhost1.example.com, and the server presents a certificate with:
Subject name: myhost.example.com
SAN: DNS: myhost.example.com; DNS: myhost1.example.com
EKU: Server authentication
Issuer: MyCA_Signing (intermediate CA)
The intermediate CA certificate (MyCA_Signing) is signed by MyCA (root CA).
The client’s Trusted CA Certificate list does not include MyCA or MyCA_Signing.
The certificate validation process is the same as in Question 17:
Name Validation: The SAN includes "myhost1.example.com," which matches the server’s hostname, so this passes.
EKU Validation: The EKU is "Server authentication," which is correct for HTTPS, so this passes.
Chain of Trust Validation: The client attempts to build a chain from the server’s certificate to a trusted root CA:
Server certificate → MyCA_Signing → MyCA Since MyCA is not in the client’s Trusted CA Certificate list, the chain cannot be validated, and the client does not trust the certificate.
Option A, "The client does not have the correct trusted CA certificates," is correct. The absence of MyCA in the client’s trust store prevents the client from validating the certificate chain.
Option B, "The certificate lacks a valid SAN," is incorrect because the SAN includes "myhost1.example.com," which is valid.
Option C, "The certificate lacks the correct EKU," is incorrect because the EKU is correctly set to "Server authentication."
Option D, "The certificate lacks a valid SAN, and the client does not have the correct trusted CA certificates," is incorrect because the SAN is valid; the only issue is the missing trusted CA certificates.
The HPE Aruba Networking AOS-CX 10.12 Security Guide states:
"For a client to trust a server’s certificate during HTTPS communication, the client must validate the certificate chain to a trusted root CA in its trust store. If the root CA (e.g., MyCA) or intermediate CA (e.g., MyCA_Signing) is not in the client’s Trusted CA Certificate list, the chain of trust cannot be established, and the client will reject the certificate. The Subject Alternative Name (SAN) must include the server’s hostname, and the Extended Key Usage (EKU) must include ‘Server authentication’ for HTTPS." (Page 205, Certificate Validation Section)
Additionally, the HPE Aruba Networking Security Fundamentals Guide notes:
"A common reason for certificate validation failure is the absence of the root CA certificate in the client’s trust store. For example, if a server’s certificate is issued by an intermediate CA (e.g., MyCA_Signing) that chains to a root CA (e.g., MyCA), the client must have the root CA certificate in its Trusted CA Certificate list to trust the chain." (Page 45, Certificate Trust Issues Section)
[References:, HPE Aruba Networking AOS-CX 10.12 Security Guide, Certificate Validation Section, Page 205., HPE Aruba Networking Security Fundamentals Guide, Certificate Trust Issues Section, Page 45.===========]
