In TLS, what is the role of certificates?

• A. They encrypt all data exchanged
• B. They bind public keys to identities and enable trust via a PKI
• C. They determine the cipher suite to use
• D. They compress the handshake data

Answer: (B)

TLS certificates primarily provide authentication and trust by binding a public key to a verified identity and enabling a chain of trust through a PKI. An X.509 certificate issued by a trusted CA states the server’s identity (such as a hostname) and contains the server’s public key. During the TLS handshake, the client validates the certificate—checking that it’s issued by a trusted authority, not expired or revoked, and that it matches the server it’s connecting to. Once validated, the public key is used to establish the session keys that will encrypt the data, either by encrypting the key material itself (in older RSA key exchange) or by signing the handshake so the ephemeral key exchange can be trusted (as with ECDHE). This role is about authenticating who you’re talking to and enabling secure key exchange, not about encrypting all data directly, not about choosing the cipher suite, and not about compressing handshake data.