# Certificate for the public key

I am new to Network Security and learning about various security features like Diffie-Helmann and others.

I understand that the Public key send by the server to the client needs to certified that it is authentic. So, a Certificate Authority (CA) needs to sign the public key. But I would like to know how is this public key signed in the certificate. Using some private key? And if so, how does the client decrypt this certificate and finally get the public key of the server? For example: how does it work in case of a TLS handshake?

• In short: The server's public key is signed using the CA's intermediate private key. The certificate doesn't need to be encrypted, it only contains public information. In TLS the certificate is send unencrypted as part of the ServerHello IIRC. – SEJPM Jul 16 '15 at 17:01
• 1. Is signed by using a digital signature (for instance RSA). Of course using some private key. The private key belongs to the CA and the client can check if it is valid using the pubic key of the CA. 2. The public key of the server is Public (not encrypted). 3. The certificate is used to authenticate the communication (avoid man in the middle attack). – 111 Jul 19 '15 at 17:51