Say your server has a certificate signed by your root CA (no intermediates for simplicity). Does this mean the private key of the root certificate is used to encrypt the hash of the server certificate? If correct, is this why you need to install the root certificate on the client (if I'm wrong, then why is this required)?

Lastly, how is the private key of the server certificate used?

  • In short: the CA signs the server certificate with the CA's private key which is similar to encrypting the hash at least for some types of keys (RSA). The root CA is needed in the client to verify if the certificate is really issued (signed) by a locally trusted CA. The private key of the server is needed to let the server prove that it owns the certificate (i.e. knows the secret private key). For more details please see the linked questions. – Steffen Ullrich Jan 28 at 21:05