When troubleshooting an SSL-based virtual server and a packet capture shows plaintext data, what is the most likely misconfiguration?

• A. Misconfiguration of the TCP profile
• B. No SSL cipher suite was selected
• C. The selected cipher suite is obsolete
• D. The SSL Certificate expired

Answer: (B)

TLS encryption requires a cipher suite for the handshake. When a client connects to an SSL-based virtual server, the server must have a cipher suite configured so it can participate in the TLS negotiation and establish an encrypted channel. If no cipher suite is selected, the TLS handshake cannot proceed, so the connection may end up or appear as plaintext traffic in a packet capture. That’s why the most likely misconfiguration is not selecting a cipher suite for the SSL profile.

If a TCP profile were misconfigured, you’d expect transport-level issues, not necessarily plaintext encryption. If the cipher suite is obsolete, encryption would still occur, just with weaker algorithms. If the SSL certificate expired, TLS progress would typically fail with a certificate error rather than simply showing plaintext data on the wire.

To fix this, configure and bind a valid cipher suite to the SSL profile used by the virtual server and ensure the certificate/key are correctly installed and valid, then verify that TLS negotiation completes and traffic is encrypted.