How can you verify a TLS certificate's issuer and validity dates within a handshake?

• A. Inspect the Certificate message in the TLS handshake; Wireshark displays the issuer and validity period.
• B. The ServerHello message contains issuer and validity dates.
• C. DNS responses include issuer.
• D. TLS Finished message contains certificate details.

Answer: (C)

The issuer and validity dates are carried by the certificate itself, not by neighboring handshake messages. During the TLS handshake the server sends one or more certificates in the Certificate message, and those X.509 certificates include the Issuer field and the validity window (Not Before / Not After). In Wireshark you can open the Certificate message and inspect the leaf certificate to see who issued it and the dates it’s valid. DNS responses do not provide certificate issuers or validity dates, and the ServerHello or TLS Finished messages do not contain certificate details. To confirm trust, also verify the certificate chain against trusted roots and ensure the current time falls within the certificate’s validity period.