7.3.1.2 TLS Server Authentication

  • When a TLS client initiates a connection with a server, the server sends its X.509 certificate chain (may or may not include the root certificate) to the client.
  • The client must authenticate the Server (verify the Server identity) before starting data exchange.
  • The client must verify the entire certificate chain and also verify that the root certificate authority of the chain is in the client’s trusted root certificate store.