What is the correct order of a certificate trust chain from end-entity to the trusted root CA?

• A. End-entity certificate -> intermediate CA -> root CA
• B. Root CA -> intermediate CA -> end-entity certificate
• C. End-entity certificate -> root CA -> intermediate CA
• D. Intermediate CA -> end-entity certificate -> root CA

Answer: (A)

The trust chain is built from the leaf (end-entity) certificate up to a trusted root. When a client validates a certificate, it starts with the end-entity certificate presented by the server, then follows the issuer field to the next certificate, and continues climbing until it reaches a root CA that the client already trusts. That path must connect the leaf to a trusted anchor, which is why the proper order is end-entity, then an intermediate CA, and finally the root CA. The root CA is typically self-signed and sits in the client’s trust store as the ultimate source of trust; intermediates exist to link the leaf to that root.

Starting with the root or placing the root in the middle would not form a valid chain for verification: the leaf must be issued by something, and that issuer must itself be issued by a higher authority, all the way up to a trusted root. In practice, there can be multiple intermediates, but the direction from leaf to root remains the same.