Signing is one of two basic operations you can perform in public key cryptography:
- encryption: encrypt with recipient's public key, decrypt with matching private key
- signature: sign with sender's private key, verify with matching public key
The goal of digital signatures using private keys is to ensure that the message is as intended by the signer and not modified. Anyone can verify the integrity of the message (in this case: a certificate).
The hash algorithm is applied to the message (the certificate contents), the output padded to the length appropriate to the key size, then signed. This ensures two things:
- we have an amount of data to sign that can be handled by the algorithm (eg: RSA, ECDSA)
- that data is a representation of the contents themselves
It is important for the certificate signature algorithm to be a safe one (with no known practical weaknesses). This is why
sha-1 are no longer recommended.
You can find more details about message signature using RSA in this crypto.se answer.