Digital certificates: signing vs verifying?

Question

I am trying to understand the two main uses of digital certificates (such as SSL certs), which are signing and verification (I believe).

In the case of SSL between a client and a web server, my understanding of certificate verification is that the browser contacts the server at a URL using HTTPS. The server then presents the browser with its SSL certificate. The browser must then verify that the SSL certificate is valid and that it belongs to the same domain as the domain in the URL.

Again, in the case of SSL between a client and a web server, my understanding of certificate signing is that the client (browser) first verifies that the server's SSL cert is valid, and if it is, the browser places the cert in its own trust store (some local, embedded DB). Subsequent request to this domain will first check to see if the server's SSL cert is in the client's trust store, and if it is, then verification is no longer required.

Am I more or less correct here, or am I way off base?

score 1 · Accepted Answer · edited May 23 '17 at 11:53

1

You're pretty much correct about verification. I would add that the browser also tries to verify the cert against a CA (Certificate Authority) but this can be waived by the user.

Beautifully explained here How are ssl certificates verified?

Signing is a different thing. When an applicant (e.g. web server) wants a CA to sign a certificate for it, it creates a key pair, private key and public key, and then prepares a CSR (Certificate Signing Request) containing among other things, the previously created public key. Then the CA then creates a signed certificate (using its own private key), that can be verified by any entity that knows this CA's public key. Web browsers have a list of the most common CA's pre-installed.

edited May 23 '17 at 11:53

Community

1
1

answered Apr 23 '14 at 19:36

imreal

10,178
2
32
48

Thanks @Nick! A quick followup question. To confirm: private keys are used to (by the CA) to sign the SSL cert, and public keys are used to verify the signatures? Thanks again! – DirtyMikeAndTheBoys Apr 23 '14 at 19:48
@Zac, yes, private to sign, public to verify. – imreal Apr 23 '14 at 19:49
And I guess, as a 2nd followup: when do SSL certs need to be verified? Just before the browser adds them to its internal trust store? – DirtyMikeAndTheBoys Apr 23 '14 at 19:49
@Zac, right, it is necessary to verify them once, then they are trusted, and the diffie-hellman key exchange begins. – imreal Apr 23 '14 at 19:53

Digital certificates: signing vs verifying?

1 Answers1