This question already has an answer here:
I'm told a root CA keeps they public/private keys totally offline. Not sure how this works with the chain of trust:
- Root CA signs CA2's certificate, verifying CA2's public key
- CA2 signs Bob's certificate, verifying Bob's public key
- Bob uses his private key to send message to Alice, and includes his certificate
- Alice wants to ensure message came from Bob, and that Bob can be trusted
- Alice trusts root CA
- Alice uses CA2's public key to verify Bob's certificate was trusted by CA2
- Not sure: How does Alice know she can trust CA2 without verifying CA2's certificate using Root CA's public key?
- Alice now trusts that Bob's certificate is trusted, and can use Bob's public key, contained within, to validate the message hasn't been tampered with.