Which expression matches the policy used to ensure client certificates presented to authentication services remain valid through GMT 2023 without expiration before that date?

• A. CLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2023)
• B. CLIENT.SSL.CLIENT_CERT.VALID_NOT_BEFORE.EQ(GMT2023)
• C. CLIENT.SSL.ORIGIN_SERVER_CERT.VALID_NOT_AFTER.EQ(GMT2023)
• D. CLIENT.SSL.CLIENT_CERT.DAYS_TO_EXPIRE.EQ(2023)

Answer: (A)

Understanding how certificate validity windows work is key here. A client certificate has a not-before date (when it becomes valid) and a not-after date (when it expires). To ensure certificates remain valid through GMT 2023, you want to constrain the end of their validity to that fixed date boundary. The policy expression that compares the certificate’s expiration (valid_not_after) to GMT2023 does exactly that: it matches certificates whose expiration aligns with that moment, effectively guaranteeing they’re valid through the end of 2023. The other expressions either check the start of validity (not before), refer to the origin server’s certificate instead of the client’s, or compare a numeric days-to-expire value, which doesn’t express a fixed year boundary.