A systems administrator needs to configure the company's web server to authenticate using PKI certificates. Which of the following servers would be queried to validate user credentials?

A DHCP server dynamically assigns IP addresses to hosts and has no role in authenticating or validating PKI certificates.

A DNS server resolves hostnames to IP addresses and does not participate in PKI certificate validation.

A Certificate Authority (CA) is the trusted entity that issues, signs, and maintains the revocation status of PKI certificates. When a web server is configured for certificate-based authentication, it queries the CA (via CRL or OCSP) to verify that a presented certificate is valid, not expired, and not revoked. This is the core function of a CA in a PKI infrastructure.

An ACL on the web server controls access based on IP addresses or rules but does not validate the cryptographic authenticity of a PKI certificate.

An LDAP server stores and retrieves directory information such as usernames and passwords but is not queried to validate PKI certificate credentials.