Once a client application downloads a leaf certificate file from some entity, issued by a CA, how does the verification of the cert's signatures work?
Specifically, I'm not clear on whether a leaf certificates signature is only crypto validated by that leaf certs public-key (the one that's embedded in the cert), or if in some way the cert of the parent CA is involved in that signature decrypt/verify process.
After the leaf cert is verified, and the app moves up the issuing chain and onto the intermediate CA cert, in the verification of that intermediate CA's signature is the root certs public key involved in some way? or does the app only need the public key of the intermediate CA to verify intermediate's signature?