I've read a lot of articles.
The client uses the information sent by the server to authenticate the server. If the server cannot be authenticated, the user is warned of the problem that an encrypted and authenticated connection cannot be established. If the server can be successfully authenticated, the client proceeds.
However, I haven't found an answer to my following question.
When a client's browser goes to a bank website, and gets the bank certificate, what does the operating system do in order to approve that this is the bank?
I think it is as follows, but please correct me if I'm wrong:
The bank sends its
public keyto the client. This certificate also has a
hashed infowhich was encrypted with the server's certificate
The client searches to see if it is a valid CA + decrypts the hashed info with the
CA public key.
The client encrypts the server's PK and also gets a hashed value to see if both hashes are the same.
Is this right?