What is a digital certificate chain, and how should a TA manage certificates?

• A. Certificate binds a public key to an identity
• B. A certificate chain is a sequence of private keys
• C. A certificate chain is used to encrypt messages end-to-end
• D. A certificate chain is used for server authentication only

Answer: (A)

A digital certificate’s purpose is to bind a public key to an identifiable subject. The certificate states whose key this is and includes details about the identity, the key, and how long the binding is valid. It is digitally signed by a trusted authority, so anyone who trusts that authority can verify that the public key genuinely belongs to that identity.

A certificate chain builds trust by linking certificates together. The leaf certificate (the one presented by a server or user) is signed by an intermediate CA, which is in turn signed by a root CA that is trusted by the relying party. Each step validates the one below it, up to a root certificate already trusted. This chain is about establishing trust, not about encrypting data, and it’s not limited to servers; certificates can also be used for clients, code signing, and more.

For how a trusted assistant should manage certificates, focus on lifecycle and trust maintenance. Manage issuance, renewal, and revocation so certificates stay current and trustworthy. Maintain up-to-date trust stores containing root and intermediate certificates, and perform revocation checks (like CRLs or OCSP) so someone can verify the status of a certificate. Protect private keys aggressively—ideally with hardware security modules—and separate duties to reduce risk. Ensure the certificate chain remains complete and valid, and configure appropriate usage constraints (key usage and extended key usage) to align with the intended purpose. These practices keep the PKI healthy and ensure that the binding between identity and key remains trustworthy.