In PKI, which action establishes trust within an internal network without relying on public CAs?

In PKI, which action establishes trust within an internal network without relying on public CAs?

• A. Install TLS not using certificates
• B. Use a public CA
• C. Obtain code signing certificates from external authority
• D. Create a local CA and issue self-signed certificates

Answer: (D)

The key idea is to create a trusted anchor inside the organization so internal systems can vouch for each other without involving public certificate authorities. By setting up a local Certificate Authority and issuing certificates for internal servers and services, you establish that internal clients should trust anything signed by that local CA. To make this work, you distribute the root certificate of the local CA to all endpoints, adding it to their trusted store. Once that root is trusted, certificates issued by the local CA serve as valid identities within the network, enabling encrypted communication and authentication without relying on public CAs. Using a public CA would move trust outside the organization, which isn’t what’s being asked. TLS that doesn’t use certificates can’t provide proper authentication, and obtaining code signing certificates from an external authority addresses code signing, not internal TLS trust.

The key idea is to create a trusted anchor inside the organization so internal systems can vouch for each other without involving public certificate authorities. By setting up a local Certificate Authority and issuing certificates for internal servers and services, you establish that internal clients should trust anything signed by that local CA. To make this work, you distribute the root certificate of the local CA to all endpoints, adding it to their trusted store. Once that root is trusted, certificates issued by the local CA serve as valid identities within the network, enabling encrypted communication and authentication without relying on public CAs.

Using a public CA would move trust outside the organization, which isn’t what’s being asked. TLS that doesn’t use certificates can’t provide proper authentication, and obtaining code signing certificates from an external authority addresses code signing, not internal TLS trust.