Who typically issues digital certificates in PKI?

• A. End Users
• B. Web servers
• C. Certification Authority
• D. Clients

Answer: (C)

Digital certificates in PKI are issued by the Certification Authority, the trusted entity responsible for vouching for identity and binding a public key to that identity. The CA verifies the subject’s identity or domain ownership, issues a certificate that includes the subject’s identity, public key, and validity period, and signs it with its private key. This digital signature allows anyone who trusts the CA to verify that the certificate truly represents the claimed entity. End users and web servers do not issue certificates; they may request or use them. Clients also don’t issue certificates themselves; they rely on the CA’s trusted root to validate certificates presented by others. The CA is the linchpin of trust in PKI, enabling secure communications by establishing and validating identities.