In PKI, what does a certificate primarily do?

• A. Encrypt all data transmitted
• B. Validate user passwords
• C. Provide offline storage for keys
• D. Bind public keys to identities

Answer: (D)

In PKI, a certificate’s main role is to bind a public key to an entity’s identity. A certificate includes the entity’s identity details, their public key, and a digital signature from a trusted certificate authority. That signature vouches that the public key really belongs to the stated entity, so others can trust that the key they’re using or receiving truly belongs to who they think it does. This binding is what enables authentication and the ability to establish secure, encrypted communications—like during a TLS handshake—without relying on password checks or separate storage mechanisms.

The other options aren’t the certificate’s primary purpose: data isn’t encrypted by the certificate itself, password validation is not performed by certificates, and offline key storage is a separate consideration from what a certificate provides.