# How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can verify later that the user's certificate as indeed signed by that CA if he has the public cert of the CA ? I'm using cryptography module in Python, and there are some functions that i can use but I'm not sure how: The representation of both certificates is X.509 , which means that one can grab the public key of the user and use verify method, this is how i used it :

caCert.public_key().verify(clientCert.signature,clientCert.tbs_certificate_bytes,padding.PSS(       mgf=padding.MGF1(hashes.SHA256()),salt_length=padding.PSS.MAX_LENGTH),clientCert.signature_hash_algorithm)


But i still get invalid signature error

## closed as off-topic by SEJPM♦, fgrieu, e-sushiOct 12 '17 at 15:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead." – SEJPM, fgrieu, e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

• You probably want to use a dedicated X.509 validation library for this instead of doing it yourself. – SEJPM Oct 12 '17 at 12:39
• Yes, I'm using this library cryptography.io/en/latest/x509/reference/… – KaramJaber Oct 12 '17 at 12:59
• Note that most certificates are not signed using PSS but rather using PKCS#1 v1.5 – SEJPM Oct 12 '17 at 13:20
• @SEJPM you are right...that was the problem – KaramJaber Oct 12 '17 at 13:35