PKI and TLS handshake: what is the role of certificates?

• A. PKI is a firewall; certificates block traffic; TLS handshake uses keys alone.
• B. PKI manages keys and certificates; certificate binds public key to identity; TLS handshake uses certificate chain to verify server identity.
• C. PKI creates random numbers; certificates generate session keys automatically.
• D. PKI is an email security standard; certificates provide spam filtering.

Answer: (B)

In TLS, certificates are what let you trust who you’re talking to and securely start a private conversation. Public Key Infrastructure creates a system of certificates that bind public keys to real identities and link them through a chain of trust back to trusted root authorities. During a TLS handshake, the server sends its certificate so the client can verify the server’s identity. The client checks that the certificate is issued by a trusted authority, is still valid (not expired or revoked), and that the certificate’s subject matches the server’s hostname. If this validation succeeds, the client uses the server’s public key from the certificate to help establish a secure, shared set of session keys (often via an ephemeral key exchange), and both sides then derive symmetric keys to encrypt the ongoing communication.

So, certificates are not just keys or a firewall function; they establish trust and enable the secure key exchange that makes TLS possible. The certificate chain is what allows the client to trust the server without prior arrangement with every server.