This question already has an answer here:
Let me explain what I mean. I've read Why is faking SSL certificate difficult, and my question is sort of a step beyond that. If some random person creates a certificate, what's stopping them from creating the certificate such that it claims it's certified by trusted certificate authority? What is the actual process of creating a certificate? I'm guessing it's more complicated than calling a function and passing it the arguments of "website", "owner", "verified by". Does a webbrowser do some hashing somewhere that can verify the certificate is authentic?