If no SSL cipher suite is selected for an SSL-based virtual server, which outcome is most accurate?

• A. The certificate expires
• B. The connection uses HTTP
• C. The client and server fail to negotiate encryption, leading to plaintext in captures
• D. The TLS version is downgraded to TLS 1.0

Answer: (C)

When a TLS/SSL connection is established, the client and server must agree on a cipher suite to use for encryption. If the SSL-based virtual server has no cipher suites configured, there’s no common set of algorithms to negotiate, so the TLS handshake cannot complete and encryption cannot be established. The outcome is that the client and server fail to negotiate encryption, which means the session cannot be secured and any data on the wire could appear as plaintext in captures. This is not about the certificate expiring, nor does it automatically switch to HTTP, and there’s no negotiated TLS version if no cipher suite is agreed.