If I understand correctly in SSL/TLS authenticity validation there are 2 (maybe more) types of certificates according to the following:
- the ones that belong to CA (these contain the public key that is used to verify other certificates)
- the ones that belong to end users (hosts) (these contain the public key that is used to encrypt channel between TLS client and TLS server)
Is this correct and how to detect of which type is the certificate when presented?
NOTE: I'm checking with wireshark. Server presented me 2 certificates, one for its domain name and one for its CA. I think I have to check the extensions field, probably id-ce-basicConstraint or id-ce-keyUsage.