Sorry for being noob, but I don't have confidence that I am understand this correctly and I could like someone to give me confirmation and help me understand.
This post helped me a lot in understanding how does the browser verify HTTPS certificate (SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?)
Here is my understanding, please correct me if I am wrong.
1) How does chain of trust works: The answer in the post described the chain of trust and how each certificate can be validated by using higher level certificate public key to verify the identity certificate.
The identity Certificate can be trusted, because the Intermediate Certificate's public key can decrypted the Identity Certificate. The Intermediate Certificate can be trusted, because the Intermediate Certificate's public key can be decrypted by the Root Certificate.
2) But then how does the browser trust the Root CA?
My understanding is that the Root CA certificate is shipped with the browser / app / OS System? So when verifying the root CA, we compare the public key and digital signature of the Root CA certificate it has embedded into the browser or OS System?
3) The installed Root CA certificate also has an expired time, it's 20 years long. When it expired, how does the browser / OS System verify the Root CA certificate anymore? We will just pray the browser will get new Root CA certificate installed into our system before it expires?