Step 3: How to verify that the certificate is signed by a trusted authority? (since anybody could send a copy of a certificate without owning the private key) Therefore I think that there must be some additional random information transmitted, which needs to be signed using the corresponding private key (perhaps also by computing a hash)?ĭoes the client decrypt this random information with the certificate's public key? How is this check performed? But the certificate alone is not sufficient to verify data authenticity. The client gets the certificate from the server during the TLS handshake.

Step 2: How to verify that the server owns the private key corresponding to the TLS certificate? The output of this process is a single certificate file that can be deployed on servers which have access to the corresponding private key. The certificate authority computes a hash value over the relevant certificate information (including the public key of the certificate aplicant), then it signs this hash value using the private key of the authority. I do understand the cryptography basics, but I am uncertain about the following three steps: