To ensure all client certificates presented to the authentication vServer are valid through year 2020, which expression should be used?

• A. DAYS_TO_EXPIRE
• B. CLIENT.SSL.CLIENT_CERT.VALID_NOT_AFTER.EQ(GMT2020)
• C. CLIENT.SSL.ORIGIN_SERVER_CERT.VALID_NOT_AFTER.EQ(GMT2020)
• D. CLIENT.SSL.CLIENT_CERT.VALID_NOT_BEFORE.EQ(GMT2020)

Answer: (B)

When checking client certificates, you need to verify their validity window using the NOT_AFTER date, which tells you when a certificate expires. To ensure certificates are still valid through the year 2020, you want to enforce that their expiration date falls in or after the 2020 boundary. The expression that compares the certificate’s VALID_NOT_AFTER to a fixed GMT2020 boundary does exactly that: it ensures the client certificate will not expire before the end of 2020, so it remains valid throughout that year.

Using the NOT_BEFORE date would check when the certificate started being valid, which doesn’t help ensure it remains valid through 2020. Checking the origin server certificate’s NOT_AFTER applies to the server’s cert, not the client’s, which isn’t what you want for client certs. And a dynamic measure like DAYS_TO_EXPIRE doesn’t tie the validity to the year boundary you’re targeting.