Question: What action is REQUIRED for all unexpired certificates issued by a compromised Security Gateway (SEG) Certification Authority (CA) in a telecom network, according to Network Domain Security (NDS) guidelines?
Option 1: Immediately terminate all existing secure connections utilizing these certificates.
Option 2: Update the certificates with new serial numbers but retain the existing key pair.
Option 3: List the certificates in Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) servers.
Option 4: Automatically renew all affected certificates with newly generated key pairs.
Explanation: When a SEG CA is compromised, to maintain security and trust within the network and across interconnections, it's crucial to ensure that all unexpired certificates issued by this CA are properly marked as revoked. This is achieved by listing them in CRLs or OCSP servers, which informs other entities in the network not to trust these certificates, thereby preventing potential security breaches. This action does not necessarily require immediate termination of existing connections unless they were very recently established after the suspected compromise time, as per NDS guidelines.