# Signature Verification: High level

I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, data goes over unsecure channel, receiver decrypts with private key.

When it comes to certificate verification that's where I start to get confused.

According to Wikipedia in the picture they show, the hash of the certificate is decrypted with signer's public key. So which is it?

I thought that maybe upon receipt, the contents of the certificate are hashed and encrypted with the public key and the result is compared with the provided "digital signature". But then I realized an attacker would be able to reproduce this process as well without knowledge of the private key.

The idea that signature generation and encryption should be seen as different concepts is actually made pretty clear in the PKCS#1 standard (of RSA laboratories): the signature generation primitive is called RSASP1 and the encryption primitive is called RSAEP. They do represent the same algorithm internally.