What would be the biggest challenge to a hacker writing a man-in-the-middle attack aimed at VPN tunnels using digital certificates for authentication?

What would be the biggest challenge to a hacker writing a man-in-the-middle attack aimed at VPN tunnels using digital certificates for authentication?

A.
Programmatically determining the private key so they can proxy the connection between the two VPN endpoints.

B.
Determining the ISAKMP credentials when passed to establish the key exchange.

C.
Determining the pase two credentials used to establish the tunnel attributes.

D.
Decrypting and encrypting 3DES once keys are known.