If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the certificate field
In the packet capture, this is returned by the server:
1) server certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted (I guess this is the certificate signature, no?)
2) intermediate CA certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted. (I guess this is the certificate signature too, no? )
My question, which key is used to encrypt the certificate signature of "server certificate" and "intermediate CA"?
If server private key is used to encrypt certificate signature for both server certificate and intermediate CA, then server's public key can be used to decrypt and view their certificate signature
If intermediate CA used its own private key to encrypt the certificate signature, then must use the intermediate CA public key to decrypt and view its certificate signature - however, the server will not have the private key of the intermediate CA, then how can this happen? Unless when configuring the certificate chaining in the server, the imported intermediate CA already has the certificate signature encrypted?
Appreciate if someone can shed some light.