Which of the following conditions must be met in order for a web browser to trust a web server certificate signed by a third-party CA?

While the web server certificate contains its public key, simply installing the public key alone is insufficient for trust; the entire certificate, signed by a trusted CA, is required for validation.

Installing the web server certificate directly on the browser is not the standard mechanism for establishing trust for public websites; trust is established via the CA that signed it.

Web browsers rely on a chain of trust; to validate a web server's certificate, the browser must have the public certificate of the Certificate Authority (CA) that signed it, or an intermediate CA in the chain, installed in its trusted root certificate store. This allows the browser to cryptographically verify the signature on the web server certificate and confirm its authenticity.

The private key of the CA certificate is a highly sensitive asset that must never be installed on a client browser; it is used by the CA to sign certificates and must remain secure at the CA.