I am developing an embedded devices FW updates (not connected to the internet) and I am using code-signing certificates in order to verify the FW update issuer identity (the FW update is signed with our private key). I implemented an ASN.1 parser in FW (can't use some known implementation because of memory restrictions) and it works well. I also have the root-CA's public key downloaded to the device in a secured manner during the production process. My question is :
When I looked for a common flow of certificate authentication and verification algorithm its stated everywhere that I should check the hostName (CN) of the CA that issued the certificate as well as the name and details if the CSR issuer. I can't seem to understand why simply checking the signature is not enough for my needs, I have the CA public key already installed so that any certificate which wasn't signed by this specific CA will fail RSA authentication. Is there a reason why I should also check the content of the certificate and not only the signature ?