I have been researching on this topic and I need to understand the exact signing and verification process when made through a trusted CA. From what I understand, this is how it works at a very high level:
- You buy a certificate with a trusted CA
- The private key of this certificate is stored securely on the server
- Messages are signed using the private key of this certificate
- On the client application, the CA store is loaded, and verification is made against it. Verification succeeds if your certificate is trusted by the CA, and fails otherwise.
- If the private key becomes compromised, you revoke the certificate, and you buy a new one. Any clients still verifying with the revoked certificate will fail verification.
Now my question is; since every CA has its own public key, and the client is verifying against that CA, and not directly with my public key, how is the link between the CA's public key and my own public key (which is signed with that CA) made? Is this linking function done internally by the CA?
Thanks in advance.