To prevent a TLS trust error indicating an untrusted Certificate Authority issuer, which certificate configuration should be ensured?

• A. Intermediate certificate linked to the Server Certificate
• B. Server Certificate installed on the client
• C. Public key of the certificate present on the client
• D. Intermediate certificate linked to the Root Certificate

Answer: (A)

TLS trust works by a chain of certificates: the server presents its certificate plus any intermediate certificates that link it up to a trusted root on the client. If the client can’t complete that chain to a root CA it already trusts, it flags the issuer as untrusted. That’s why the fix is to ensure the intermediate certificate is linked to the server certificate, meaning the server sends the full chain, including the intermediate certificate, along with its own certificate. With the complete chain, the client can trace from the server certificate up through the intermediate(s) to a root CA it already trusts. Installing a certificate on the client doesn’t fix the chain, and simply having the root or public key on the client won’t bridge the missing intermediate certificates.