How do keystore and truststore differ in their primary purpose?

How do keystore and truststore differ in their primary purpose?

• A. Keystore stores only public certificates
• B. Truststore stores private keys
• C. Keystore stores private keys for local use, and truststore stores public certificates of trusted parties
• D. Truststore stores certificate signing requests

Answer: (C)

Keystore and truststore serve different roles in TLS and secure communications. A keystore holds the private keys that belong to your own identity and the corresponding certificate used to prove who you are or to sign data. A truststore, by contrast, contains the public certificates of parties you trust (typically CA certificates or specific server certificates) so you can verify their identity during a TLS handshake. This distinction makes the statement that a keystore stores private keys for local use, while a truststore stores the public certificates of trusted parties the best description. For example, in a TLS connection, the server uses its keystore to present its certificate and prove its identity, while the client uses its truststore to verify that certificate against trusted CA certificates. If mutual TLS is in play, the client may also present its own certificate from its keystore, which the server then verifies using its truststore.

Keystore and truststore serve different roles in TLS and secure communications. A keystore holds the private keys that belong to your own identity and the corresponding certificate used to prove who you are or to sign data. A truststore, by contrast, contains the public certificates of parties you trust (typically CA certificates or specific server certificates) so you can verify their identity during a TLS handshake.

This distinction makes the statement that a keystore stores private keys for local use, while a truststore stores the public certificates of trusted parties the best description. For example, in a TLS connection, the server uses its keystore to present its certificate and prove its identity, while the client uses its truststore to verify that certificate against trusted CA certificates. If mutual TLS is in play, the client may also present its own certificate from its keystore, which the server then verifies using its truststore.