I've read a lot of articles.
The client uses the information sent by the server to authenticate the server. If the server cannot be authenticated, the user is warned of the problem that an encrypted and authenticated connection cannot be established. If the server can be successfully authenticated, the client proceeds.
However, I haven't found an answer to my following question.
When a client's browser goes to a bank website, and gets the bank certificate, what does the operating system do in order to approve that this is the bank?
I think it is as follows, but please correct me if I'm wrong:
The bank sends its
certificate
and itspublic key
to the client. This certificate also has ahashed info
which was encrypted with the server's certificateprivate key
.The client searches to see if it is a valid CA + decrypts the hashed info with the
CA public key
.The client encrypts the server's PK and also gets a hashed value to see if both hashes are the same.
Is this right?