How can a browser trust a web-server certificate signed by a third party CA?

A browser trusts a web-server certificate if it can verify the certificate's signature using the corresponding public key of the Certificate Authority (CA) that issued it, which means the CA certificate must be present and trusted in the browser's certificate store.

While installing the web-server certificate directly would establish trust, the standard and scalable method for trusting certificates signed by a CA is to trust the CA itself, not each individual server certificate.

The private key of the CA must remain confidential and is used by the CA to sign certificates; it should never be installed on client browsers.

The web-server certificate contains the web-server's public key; however, merely having this key does not establish trust, as the browser needs to verify the certificate's authenticity by checking the CA's signature using the CA's public key.