An administrator needs a certificate from a public certificate authority for a new web server. What should the administrator do FIRST?
Select an answer to reveal the explanation.
Short Explanation
Before the CA can vouch for you, you've got to fill out the application. That's the CSR, and it carries your public key, never your private one. If you ever see an answer that ships a private key off the box, you've found the trap.
Full Explanation
The certificate request process begins on the system that will use the certificate. The administrator generates a public and private key pair, keeps the private key on the server, and creates a certificate signing request containing the public key and identifying information such as the domain name, signed with the private key to prove possession. The CSR is submitted to the CA, which validates the request according to the certificate type and returns a signed certificate that binds the public key to the identity. Sending the private key to the CA violates the basic principle of asymmetric cryptography; the private key must remain under the owner's control, and the CA never needs it. Downloading and importing the CA's revocation list is unrelated to obtaining a new certificate; revocation lists are used by relying parties to check status. Creating a self-signed certificate and asking the CA to countersign it is not how public certificate issuance works; the CA issues a new certificate from the CSR rather than endorsing an existing self-signed one. Exam caveat: CSR generation is listed under certificates because it is the step where key ownership and identity are asserted. Operational check: generate the key with an approved algorithm and length, protect the private key file with restrictive permissions or a hardware module, and confirm the CSR fields match the hostnames the server will present.