I know how the basic process of digital certificate, but how do I detect if the public key in a digital certificate is modified?

  • This is not very appropriate question, as it asks about something, that is the core of the design of digital certificates. Just carefully reading what they are should answer this. I believe this question may be useful however for people making a quick google, so you have an answer there. – Peter Harmann Apr 27 '18 at 22:11

The digital signature underneath the certificate - generated by the Certificate Authority (CA) that issued the certificate - will not verify if the public key is changed. The only way someone could "change" the public key without the certificate failing verification is if the adversary compromises a trusted CA, or maybe more exactly your CA depending on how closely you inspect the certificate.

In more detail, the CA has a private key in possession and the corresponding public key is installed in all operating systems and browsers. The CA uses the private key to sign a certificate and then the browser / OS checks the signature using the trusted public key. If the signature is correct, the public key in the certificate cannot have been changed.

It is possible that more intermediate certificates are used, where the parent certificate can be used to verify the child certificate. This is called a chain of trust, starting with a leaf certificate and ending with a certificate in the trust store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.