As far as I know,
when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public key.
The digital signature is a data which was created (not encrypted!) by their
Private key over my
Now, a client connects to my site (which has a SSL certificate).
- He reads the digital signature (from the certificate)
- He knows which algorithm used to create this signature, and he runs the hash again over my certificate data
- Client uses his public key (in his store) of Verisign to decode (not decrypt) the digital signature
- if there is a match - all fine.
- client generates a random number, encrypts it with my public key, and my server accept it and from now on - we are in symmetric mode.
I have the following questions:
Was I right ?
Verisign creates the digital signature over my certificate data. Which data?
The digital signature was created by what operation(?) over my certificate data? (Is this hashing?)
(I am not a cryptographer, but a programmer who wants to understand this stuff.)