In certificate path validation, what is a trust anchor?

• A. The leaf certificate for the domain
• B. A trusted CA certificate in the verifier trust store
• C. A CRL distribution point
• D. A timestamp used for certificate validity

Answer: (B)

In certificate path validation, the trust anchor is the root of trust—the certificate from a CA that the verifier already trusts, usually stored in the verifier’s trust store. It’s typically a self-signed root certificate that serves as the starting point for building the chain of trust. When validating, each certificate in the chain is checked against the one above it until it reaches this pre-trusted root; if the chain is intact up to the trust anchor, the end-entity certificate is considered trusted. The leaf certificate, on the other hand, is the site’s own certificate, not the starting point of trust. A CRL distribution point is simply where revocation lists are retrieved, not a source of trust. A timestamp relates to when a certificate is valid, not to establishing trust.