What is the correct resolution for a certificate trust error that indicates the certificate authority is not trusted?

• A. The certificate private key must be on client devices
• B. The certificate public key must be on client devices
• C. The server certificate must be linked to its intermediate and root certificates
• D. The server certificate must be installed on the client devices

Answer: (C)

Trust is established through a chain of certificates that starts with the server’s certificate and links up to a root certificate that the client already trusts. When a certificate authority isn’t trusted, the client can’t complete that chain, so it cannot verify the server’s identity.

The correct approach is to ensure the server presents the entire certificate chain: the server certificate, any needed intermediate certificates, and the root certificate (or at least a chain that leads to a trusted root). This allows the client to build a path from the server’s certificate to a root it already trusts, resolving the trust error.

The other options don’t fix the underlying issue. The private key on the client is unrelated to trust; the public key on the client is not what establishes trust in this scenario; and simply installing the server certificate on clients doesn’t guarantee a complete, trusted chain unless the full chain of intermediates and the trusted root is also present.