What is a certificate chain and why is validation important?

• A. A chain of routers.
• B. A single certificate used by all servers.
• C. A sequence of encryption keys.
• D. Chain from root CA to end-entity certificate; validation ensures trust and proper permissions.

Answer: (D)

A certificate chain is a sequence that connects a server’s certificate up to a trusted root certificate authority, creating a line of trust. In practice, the server presents its certificate, which is signed by an intermediate CA, which may be signed by another intermediate, all the way up to a root CA that the client already trusts. The client uses this chain to verify that the server’s identity is legitimate: it checks the digital signatures along the chain, ensures each certificate is still valid, and confirms the end certificate matches the server’s domain. The root CA is trusted because the client already has its root certificate in its trusted store, so if the chain can be validated to that root, trust is established.

Validation is important because it confirms who issued the certificate and that the certificate belongs to the intended entity. It prevents impersonation by making sure the certificate chain is intact, current, and anchored to a trusted authority. Without validation, a server could present any certificate, and you wouldn’t have a reliable way to know whether you’re communicating with the legitimate party or an attacker.

Note what isn’t being described here: a chain of routers isn’t involved in creating trust, a single certificate used by all servers bypasses the chain of trust, and a sequence of encryption keys alone doesn’t provide the identity verification and authority conveyed by a certificate chain.