I have just started with encryption and stuff, so please bear with me. Just playing around.

I have an upstream service that has sent us a self-signed cert. Now from what I understand, we can verify if a public key belongs to someone by using the below function:

func(CA's public key, digital signature, supplied public key) 
returns true/false

Now since it's a self-signed cert, the CA's public key should be the same as the supplied public key, right?

I have the upstream service cipher in my truststore (means I have the certificate that contains the public key and the digital signature). And it's public key in my keystore (please correct me if I am wrong, I am very new to this stuff). I want to verify that this public key belongs to the upstream client? Can it be done using OpenSSL? Using a Mac.

  • You can't verify that a self-signed certificate comes from anywhere unless you know how it got to your computer (i.e. via a TLS tunnel which you trusted based on some other root CA). You can't verify a self-signed (not cross-signed) certificate using PKI. You just trust it or you dont. – Jenessa Aug 19 at 11:04
  • How does the application do it then? It somehow has to verify that the public key actually belongs to the client. – Prashant Pandey Aug 19 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.