I am having trouble to understand how a TLS certificate is authenticated.

From what I read, a server's leaf certificate contains:

  • Server domain name
  • Server public key
  • Issuer (CA) domain name
  • Issuer (CA) signature of this certificate

How is the issuer signature of the certificate verified? Is it a hash function using the upper certificate's public key as an input? Like:

childCertificateSignature = hash(childCertificate, upperCertificatePrivateKey)

and to validate:

isChildCertificateValid = isHashValid(childCertificateSignature, upperCertificatePublicKey)




Browse other questions tagged or ask your own question.