I am trying to understand the difference between digital signature and digital certification and how they work as a whole together on a high level perspective. I hope gurus here can point to me if my understanding is wrong.
When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be used.
*In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key.
But first, the authenticity of the webserver must be confirmed. Hence, the webserver sends the user/client its digital certification. Inside the digital certification, it contains the public key use by the webserver to be use for asymmetric encryption at 2).
This digital certification is being issued by the Certificate Authority which checks and verifies to prove that the webserver/domain does really belong to whom it is suppose to belong to.
*However again, how do we prove the authenticity and integrity of the digital certification? For integrity, the digital certificate is hashed and sent together with the original certificate. For authenticity, the hashed digital certificate is signed with the CA's private key.
*So if the digital certificate is signed by the CA's private key, how do we get CA's public key? The overall idea I have is that public keys from CA are preinstalled in many browsers.
With the public key of the CA, the digitally signed hash/certificate is decrypted and to produce the original hash. The client then hash the received certificate and compare it with the original hash. If the 2 hash results matched, the certificate is not tampered.
With the digital certificate, the public key used by the webserver is retrieved by the webclient/user. The webclient/user then use this public key to encrypt the information of building the symmetric key over to the webserver.
With the symmetric key being known and created on both sides, encrypted communication can begin.
Questions:
Is my understanding correct?
For 2*, is the session key created by the web client and sent to the webserver for use directly (encrypted) or is it setup by exchanging information that end up having both sides with the same session key (Diffie Hellman algorithm?)?
For 5,* I have never applied for a digital certificate before. When the CA issue a digital certificate, does it really issue the digital certificate? Or does it just issue a digitally signed hash of the certificate.
Else, how do we send the digital certificate (original) and its digitally signed hashed version without the CA private key?
For 6*, is my understand correct that CA's public key come preinstalled with the browsers?
Does the client need to authenticate with the webserver? (I read about having the client sending cert to the webserver as well).
What will be put in the truststore on the webclient, and what will be put in the keystore on the webserver?