Which of the following best describes the certificate chain in PKI?

• A. A chain of IP addresses used for routing.
• B. Only the end-entity certificate is needed.
• C. Root CA, intermediate CA(s), and end-entity certificate; the chain leads to the trusted root for validation.
• D. A series of private keys.

Answer: (B)

The chain is about building a path of trust from the end-entity certificate up to a root authority that the client already trusts. It includes the end-entity certificate, any intermediate certificates, and the root CA certificate. The purpose is to validate the end-entity’s signature by following the chain to a trusted root; the root is self-signed and pre-installed in clients, and intermediates bridge trust from the root to the end-entity. In practice, servers may send the end-entity certificate along with any missing intermediates so the client can construct the full chain and verify it against the trusted root.

Saying only the end-entity certificate is needed is not correct because you must have the issuer’s certificate (and any further intermediates) to verify the chain up to a trusted root. The idea of a chain being a series of private keys is also not correct, since the chain is about certificates and the public keys they contain, not a sequence of private keys.