Which of the following is responsible for maintaining certificates in a public key infrastructure (PKI)?

Internet Authentication Server (IAS) is Microsoft's legacy RADIUS-based network access authentication service used to validate remote access credentials, not an entity that issues or maintains PKI certificates.

A Certificate User is the endpoint entity that receives and presents certificates issued by the CA; it consumes trust but does not manage or maintain the certificates themselves.

A Certification Authority is the core trust anchor of any PKI deployment, responsible for issuing digital certificates that cryptographically bind a public key to an identity, maintaining certificate validity through renewals, and publishing Certificate Revocation Lists (CRLs) or supporting OCSP responses to invalidate compromised or expired certificates. Without a CA, no mechanism exists to establish chain-of-trust verification across the infrastructure.

A Domain Controller manages Active Directory directory services and Kerberos-based authentication but does not issue or maintain PKI certificates unless the Active Directory Certificate Services role is explicitly installed and configured on it.