What is the recommended action if you need to verify that all client certificates presented to an authentication vServer are valid up to a specific year?

• A. Check valid until year using the VALID_NOT_AFTER expression
• B. Check valid from year using the VALID_NOT_BEFORE expression
• C. Check certificate chain length using DAYS_TO_EXPIRE
• D. Check origin server certificate validity only

Answer: (A)

Verifying a fixed end-date for client certificates relies on comparing the certificate’s expiry date to a chosen cutoff. Client certificates contain a notAfter field that marks when they expire. To ensure all certificates presented to the authentication vServer are valid only up to a specific year, you enforce this boundary by evaluating the certificate’s notAfter date with the VALID_NOT_AFTER expression in your policy. By setting the cutoff to the last day of that year, any certificate that would expire after that date is rejected, while certificates expiring on or before the cutoff are accepted. This directly enforces the required validity window.

The other checks aren’t aligned with this goal: testing the notBefore date would address when a certificate becomes valid, not when it ends; using DAYS_TO_EXPIRE isn’t a precise fixed-year boundary and is more about remaining lifetime than a hard cutoff; and focusing on the origin server’s certificate has no bearing on validating the client certificates presented to the vServer.