In TLS, what does certificate chain validation ensure during the handshake?

• A. It validates the certificate chain against trusted roots and confirms identity before key exchange.
• B. It ensures the client has a valid user account on the server.
• C. It confirms the router's certificate is valid.
• D. It bypasses certificate verification for speed.

Answer: (A)

In TLS, the handshake is built to trust the server before any keys are exchanged. The certificate chain validation checks that the server’s certificate can be traced up to a trusted root authority in the client’s trust store and that the certificate is valid for the server’s hostname. This binding of the server’s identity to a chain anchored in a trusted root prevents a man‑in‑the‑middle from presenting a fake certificate.

If the chain cannot be validated, or the hostname doesn’t match, the client aborts the handshake, so no keys are exchanged. Some setups also perform revocation checks to ensure none of the certificates have been revoked.

So, the best description is that you validate the certificate chain against trusted roots and confirm the server’s identity before proceeding with the key exchange. This is not about validating a user account, it’s not about a router’s certificate, and bypassing verification would defeat the security purpose of TLS.