What is a certificate and how does the chain of trust work?

A certificate is a digitally signed document that binds an identity (such as a domain name or a device ID) to a public key; the signature is made by a Certificate Authority (CA) attesting that the named entity owns that public key. The chain of trust is how a device decides to believe a certificate it's never seen. The device ships with a small trust store of root CA certificates it trusts implicitly. When a server presents its certificate, that certificate is typically signed not by a root directly but by an intermediate CA, which is in turn signed by a root, so the device walks the chain: server certificate ← intermediate ← root, verifying each signature with the issuer's public key, until it reaches a root it trusts. It also checks that every certificate in the chain is within its validity period, that the leaf certificate's name matches the host it intended to reach, and that nothing is revoked. If the chain terminates at a trusted root and all checks pass, the device trusts the server's public key; if the chain doesn't reach a trusted root, or any certificate is expired or name-mismatched, validation fails and the connection must be aborted. This delegation is what lets a device trust millions of servers it's never encountered by trusting only a handful of root CAs, and it's why managing the device's trust store (which roots it carries, and updating them as CAs rotate) is an operational concern over a long deployment.