Which component handles certificate trust lists?

Which component handles certificate trust lists?

• A. The endpoint trust store on devices
• B. The certificate authority server in the network
• C. The endpoint trust store/ITL/CTL mechanism in Cisco endpoints.
• D. The DNS server used for SIP domain discovery

Answer: (C)

On Cisco endpoints, certificate trust is managed locally by the device through its trust store, with Cisco’s ITL (Integrity Trust List) and CTL (Certificate Trust List) mechanisms handling how those trust lists are created, distributed, and enforced. The trust store contains the trusted root certificates, while CTL and ITL define and enforce which certificates the endpoint will actually accept for TLS connections. This combination lets admins centrally control which servers and certificates the endpoint trusts, and the device uses those trust lists to validate certificates during secure communications. Central CA servers issue certificates, but the endpoint’s trust decisions come from its local trust store plus the CTL/ITL mechanism, not from DNS or a generic CA server.

On Cisco endpoints, certificate trust is managed locally by the device through its trust store, with Cisco’s ITL (Integrity Trust List) and CTL (Certificate Trust List) mechanisms handling how those trust lists are created, distributed, and enforced. The trust store contains the trusted root certificates, while CTL and ITL define and enforce which certificates the endpoint will actually accept for TLS connections. This combination lets admins centrally control which servers and certificates the endpoint trusts, and the device uses those trust lists to validate certificates during secure communications. Central CA servers issue certificates, but the endpoint’s trust decisions come from its local trust store plus the CTL/ITL mechanism, not from DNS or a generic CA server.