During a bank TLS handshake the server certificate crosses the network, and the server long-term private key does not. Which of these is supposed to stay off the wire?
Select an answer to reveal the explanation.
Short Explanation
The certificate is the name badge you pin on in public; the private key is the stamp that stays in the drawer. During this bank handshake the certificate crosses the network, and the long-term private key is what should stay off the wire. The trap is hiding the public key, the serial number, or the DNS name instead.
Full Explanation
A TLS server sends its certificate so the client can see the public key and the identity. The long-term private key stays on the server and is used locally. It is not part of the certificate that crosses the network. The item that stays off the wire is "The server long-term private key, kept off the wire while the certificate is sent". The public key is inside that certificate and is meant to travel, so "The public key inside the server certificate, held back so clients do not receive it" has the direction reversed. The serial number is a certificate field and travels with the certificate, so "The certificate serial number, held back so clients cannot identify the certificate" fails. The DNS name is identity material in the certificate and is sent with it, so "The DNS name on the certificate, held back so clients cannot find the bank server" fails. Exam caveat: the server uses the private key during the handshake without transmitting the key itself. Operational check: confirm the capture contains the certificate, and confirm the private-key material is not present in that same capture.