Which type of certificate is typically used to enable secure client connections to StoreFront after provisioning?

• A. Server
• B. Client
• C. Intermediate
• D. Root

Answer: (A)

Secure client connections to StoreFront rely on a server certificate installed on the StoreFront web server to enable HTTPS and to authenticate the server to clients. This certificate is what the client receives during the TLS handshake, proving the server’s identity and enabling encryption for the session. For this to work smoothly, the certificate should be a server authentication certificate (EKU includes Server Authentication), issued by a trusted Certificate Authority, and bound to the StoreFront IIS site with a common name that matches the StoreFront URL.

A client certificate is used for mutual authentication, where the client must present its own certificate to prove its identity. That’s not the standard method used to secure StoreFront connections for typical deployments. Intermediate certificates are part of the trust chain and may be installed to help clients validate the server’s certificate, but they are not the certificate presented to clients as the identity of the StoreFront server. Root certificates are trusted anchors in the client’s store; they aren’t used as the certificate the server presents during TLS.

So the best choice is a server certificate, because it directly provides the TLS-secured channel and server identity required for StoreFront client access.