Parks procurement reviews a playground-vendor site whose homepage brand does not match the organization named on the public TLS certificate. How should that mismatch be used?
Select an answer to reveal the explanation.
Short Explanation
A TLS certificate is like the name on the deed while the homepage is the painted sign. When they disagree, that is a due-diligence flag, not a license to attack TLS. Write down the public cert fields and keep collecting.
Full Explanation
When parks procurement reviews a playground-vendor site whose homepage brand does not match the organization named on the public TLS certificate, that mismatch should be noted as a due-diligence flag that disagrees with on-page branding. Public certificate subjects are PKI-visible clues about who operates the host. Treating the mismatch as proof the site must be taken down by exploiting a TLS flaw fails as unauthorized attack. Ignoring certificates because marketing brand text always overrides public PKI fields fails; certificates are independent public artifacts. Demanding the vendor’s private key so the city can reissue the certificate overnight fails as an improper and dangerous request outside OSINT. Exam caveat: brand/cert mismatches can be CDN, hosting, or subsidiary arrangements—flag and verify, do not auto-conclude fraud. Operational check: record certificate subject and SANs with retrieval date; compare to homepage legal/brand names and state filings; ask procurement clarifying questions based on the flag rather than exploiting TLS. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.