How can you view the server certificate chain presented during a TLS handshake?

• A. In the TLS Certificate message, expand to view each certificate's subject, issuer, and validity
• B. In the TLS Certificate message, directly see only the leaf certificate
• C. In the CertificateRequest message
• D. In the TLS Alert message

Answer: (D)

The server certificate chain is delivered as part of the TLS handshake in the Certificate message. In Wireshark, look at the Server’s TLS handshake and open the Certificate message; you’ll see a list of certificates—the leaf server certificate plus any intermediates up to the root. Expanding that certificate list lets you view each certificate’s subject, issuer, and validity. The CertificateRequest message is used to request a client certificate (for mutual TLS), not to present the server’s chain, and the TLS Alert message is for signaling errors or closure, not for carrying the certificate data.