Complete the OpenSSL command used to validate a certificate against a trusted CA file: `openssl ______ -CAfile ca.crt server.crt`

### Why this is right The `-CAfile` argument identifies the CA certificate file that OpenSSL should use when checking the server certificate. In this example, `infinityca.crt` is the CA certificate and `conestoga.crt` is the certificate being verified. ### The concept Certificate verification checks whether the certificate’s signature can be validated using the CA’s public key, which is carried in the CA certificate. This check is useful only when the verifier has a reason to trust that CA certificate. A successful signature check does not by itself prove that every certificate detail is suitable for a particular server or connection. The certificate’s subject, validity period, and intended use still matter. ### Terms - **OpenSSL**: A software toolkit used for cryptographic operations, including creating and checking certificates. - **Certificate verification**: Checking whether a certificate’s signature is valid relative to a supplied CA certificate. - **CA certificate**: A certificate containing the CA’s public key and identifying information. - **Public key**: The shareable key used here to check the CA’s signature on an issued certificate. - **Signature**: A cryptographic result used to detect alteration and identify the key that signed data. ### Remember The `-CAfile` option supplies the CA certificate used to check the issued certificate.