Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, GoDaddy, etc, in place of signing a certificate myself? If so, what mechanism do I need to use to verify it? Will CRL or OCSP have details from all CAs or will I need to check their individual registers?
Original: I'd like to know how I verify the validity of certificates from various CAs for the purpose of mutual authentication on a website, or whether this is even an issue to be considered?
I am in the process of learning about mutual authentication and how it works, along with certificate signing in general so any pointers or references to read to help understand this subject would be appreciated.
Currently I have a simple Ubuntu Server running in a VirtualBox that I am using to experiment with. This is running nginx and mysql, both of which are configured to require TLS/SSL. The next step I want to implement is mutual authentication between nginx and the client browser; I have successfully set this up on the server using a self-signed CA certificate. However, I am struggling to understand how the certificate sent by the browser is verified.
I have a public/private key pair on the host OS, and I could feasibly generate a certificate signing request and send it to the guest server, which could sign it against the CA certificate and return it to my host. This certificate will be signed, but not by a registered CA. Taking this one step further, I now visit another website that I do not control: does it need to sign my certificate also?
My understanding is that once a certificate has been signed that is it, it does not need to be signed again except for renewal. This is only true if signed by a registered CA such as GoDaddy, CACert, etc. Therefore, back to my website, how do I know whether this is a valid certificate? If I use CRL or OCSP to check whether it has been revoked or not, will it check for all providers or just the company who maintains the list/server?
Assuming that one way or another I can validate the authenticity of the certificate, how do I then use that to authenticate (or, I suppose more accurately, authorise) the specific user? Do I need to store a copy of their public key and check against this or is it possible to extract some unique detail that would enable me to authorise them?
This is a new area for me and I have undoubtedly made some incorrect assumptions as well as exposed some gaps in my knowledge and understanding of the subject. I'd appreciate any answers that will help correct these. Also, if the question isn't specific enough for forum rules I apologise and any guidance on how to better frame it so it doesn't violate the rules would be helpful.