When establishing a PKI in a local network without a public CA, what is a typical step?

When establishing a PKI in a local network without a public CA, what is a typical step?

• A. Acquire an EV certificate from a public CA
• B. Create a local CA and issue self-signed certificates
• C. Use certificate pinning to a remote server
• D. Enable only HTTP, never HTTPS

Answer: (B)

When you’re in a private network with no public CA, the typical step is to establish your own PKI by creating a local Certificate Authority and issuing certificates from that CA. This gives you a trusted backbone for TLS within the organization because every certificate can be signed by your internal CA. You’d then distribute the root certificate of that local CA to all client devices so they trust the internal services, and you manage certificate lifetimes, revocation, and policy from a central point. This approach avoids dependence on public CAs and keeps control entirely in-house. The other options aren’t the right fit here: using an EV certificate from a public CA requires external trust and is unnecessary for internal services; certificate pinning to a remote server doesn’t establish an internal PKI; and enabling only HTTP means TLS isn’t used at all, which defeats PKI objectives.

When you’re in a private network with no public CA, the typical step is to establish your own PKI by creating a local Certificate Authority and issuing certificates from that CA. This gives you a trusted backbone for TLS within the organization because every certificate can be signed by your internal CA. You’d then distribute the root certificate of that local CA to all client devices so they trust the internal services, and you manage certificate lifetimes, revocation, and policy from a central point. This approach avoids dependence on public CAs and keeps control entirely in-house.

The other options aren’t the right fit here: using an EV certificate from a public CA requires external trust and is unnecessary for internal services; certificate pinning to a remote server doesn’t establish an internal PKI; and enabling only HTTP means TLS isn’t used at all, which defeats PKI objectives.