Which statement best describes certificate path validation?

• A. The chain ends at a trusted anchor, and each certificate signs the next up to the anchor
• B. The leaf certificate must be trusted directly by the user
• C. Only the root certificate is checked
• D. Certificates do not need to be validated

Answer: (A)

Certificate path validation checks trust by building a chain from the presented certificate up to a certificate that your system already trusts. You start with the leaf certificate and verify that each certificate is properly signed by the next one up in the chain. That means the leaf is signed by its issuer, that issuer is signed by its issuer, and so on, until you reach a root or trusted anchor. The crucial point is that the chain must end at a trusted anchor that’s in your trust store. If every link in the chain is valid and the root is trusted, the certificate is considered trustworthy. This allows a leaf certificate to be trusted even if it isn’t directly known to the user, as long as a valid chain to a trusted root exists.