To verify that all client certificates presented to the authentication vServer are valid through the year 2023, which expression should you use?

To verify that all client certificates presented to the authentication vServer are valid through the year 2023, which expression should you use?

• A. CLIENT.SSL.CLIENT_CERT.VALID_NOT_BEFORE.EQ(GMT2023)
• B. CLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2023)
• C. CLIENT.SSL.ORIGIN_SERVER_CERT.VALID_NOT_AFTER.EQ(GMT2023)
• D. CLIENT.SSL.CLIENT_CERT.DAYS_TO_EXPIRE.EQ(2023)

Answer: (B)

The expression uses the client certificate’s expiration date, which is the NOT AFTER date of the certificate. To ensure that all client certificates presented to the authentication vServer are valid through the year 2023, you want to verify that their expiration occurs within or by the end of 2023. Checking VALID_NOT_AFTER against GMT2023 does exactly that: it filters for certificates whose expiration date falls in 2023, meaning they remain valid for the year. The other options aren’t suitable for this goal. Checking VALID_NOT_BEFORE would look at when the certificate starts being valid, not when it ends, which doesn’t ensure validity through 2023. Inspecting the origin server’s certificate targets a different certificate (the server’s, not the client’s). And comparing DAYS_TO_EXPIRE to a fixed number doesn’t correspond to a year-bound validity check.

The expression uses the client certificate’s expiration date, which is the NOT AFTER date of the certificate. To ensure that all client certificates presented to the authentication vServer are valid through the year 2023, you want to verify that their expiration occurs within or by the end of 2023. Checking VALID_NOT_AFTER against GMT2023 does exactly that: it filters for certificates whose expiration date falls in 2023, meaning they remain valid for the year.

The other options aren’t suitable for this goal. Checking VALID_NOT_BEFORE would look at when the certificate starts being valid, not when it ends, which doesn’t ensure validity through 2023. Inspecting the origin server’s certificate targets a different certificate (the server’s, not the client’s). And comparing DAYS_TO_EXPIRE to a fixed number doesn’t correspond to a year-bound validity check.