So I just came to know about Digital certificates, and this is what I understand. Public Key, Message + PK_encrypt(Hash(message))/Message Signing, And other identifiers is what a digital signature is. The Signed message is decrypted by the client and if the client computed hash of the message is identical to the signed one, then the client is sure of integrity. But How does the client makes sure of the CA? From what I understand, Some values from a CSR is signed with CA's PK and the signature is added to the digital cert that the leaf node sends to the user. The user already has the Public Key of the CA inbuilt, and can verify the authenticity of the leaf node. Am I even close to being right?