Question

During an audit of a company's public-facing e-commerce site, an IS auditor notes that customers' browsers display a security warning when connecting via HTTPS. Investigation shows the web server presents a certificate that was issued and signed by the company's own internal certificate authority rather than a publicly recognized CA. Which of the following BEST explains why the browser warning appears?

Accepted Answer

The signing CA's root certificate is not in the browsers' trusted root store, so the certificate chain cannot be validated

Answer

The certificate uses asymmetric encryption, which browsers no longer support for TLS sessions

Answer

The certificate's private key is stored on the web server rather than in a hardware security module

Answer

The certificate has not yet been published to a certificate revocation list (CRL)