According to RFC 3280 a certificate's basic syntax is

Sequence := 

In tbsCertificate, SubjectPublicKey is the public key of the server. The signature value is encrypted with the private key of the server (if I am not wrong). How will I decrypt the signature value (to validate the certificate) if it can only be decrypted by the server's private key?

1 Answer 1


I'm sorry you don't need the private key to "decrypt" something encrypted using asymmetric encryption, you need the public key, which is in the certificate, or the certificate of the trusted authority. Using the public key also provides proof that the private key was indeed used.

See this prior entry Digital Signature and Verification? and this: how digital signature verification process works

  • reading your answer and the posts you have given the link to, I need public key to decrypt the signatureValue ? and also encrypting the data with private key is signing ? Apr 30, 2016 at 23:06
  • Saying you need the public key to decrypt is wrong. Public keys encrypt and verify, Private keys decrypt and sign. Im sure you know what you are talking about but your answer is misleading.
    – Luke Park
    May 1, 2016 at 12:29
  • @LukePark so I will encrypt the whole certificate with the public key given in certificate and compare those encrypted messages to verify ? May 2, 2016 at 0:25
  • @MamoonAhmed No. The certificate contains the signature already. You use the public key to verify (decrypt) the signature, which will give you a hash. Compute the hash of the rest of the certificate and compare those.
    – Luke Park
    May 2, 2016 at 0:28
  • @LukePark Thank you so much for the answer. another question is ? a data encrypted with a private key can be decrypted with public key ? May 2, 2016 at 0:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .