An agency analyst captures the server certificate during a TLS handshake and reports that the private key was stolen because that certificate crossed the network. What correction should the SOC lead give?
Select an answer to reveal the explanation.
Short Explanation
A name badge is meant to be shown at the door, while the private stamp stays in the safe. You are seeing a certificate, so the public key on the wire is supposed to travel. The trap is treating that capture as proof the private key was stolen.
Full Explanation
A server certificate is published so peers can authenticate the server. The object on the wire carries the public key in the certificate, and that key is intended to be copied by any client that completes the handshake. After the handshake, the session protects application data with symmetric keys, not by shipping the server private key. "The certificate carries the public key, and sharing that key is expected" is the correction. "Every certificate seen in a capture is proof the private key was copied" treats a normal handshake artifact as a compromise. "The cipher suite string from the handshake is itself the server private key" confuses an algorithm name with key material. "TLS places the server private key in the ClientHello for the peer to read" invents a field the ClientHello does not carry. Exam caveat: seeing a certificate in a capture does not show that the private key left the server. Operational check: open the certificate in the capture and confirm the subject and public key are present, with no private key field. The private key stays on the server.