Question

A SOC analyst investigating a service outage finds that users cannot connect to an internal HTTPS application and their browsers display a warning that the connection is not private. The application's TLS certificate was issued exactly one year ago by the organization's internal PKI. No configuration changes were made to the server or the application code. What is the MOST likely cause?

Accepted Answer

The certificate has expired and needs to be renewed and reissued by the internal CA

Answer

An attacker is performing a man-in-the-middle attack by injecting a rogue certificate

Answer

The symmetric session key negotiated during the TLS handshake has been compromised

Answer

The server's private key was published to the network, breaking asymmetric encryption