# How can i verify a certificate to root? [closed]

I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can verify later that the user's certificate as indeed signed by that CA if he has the public cert of the CA ? I'm using cryptography module in Python, and there are some functions that i can use but I'm not sure how: The representation of both certificates is X.509 , which means that one can grab the public key of the user and use verify method, this is how i used it :

caCert.public_key().verify(clientCert.signature,clientCert.tbs_certificate_bytes,padding.PSS(       mgf=padding.MGF1(hashes.SHA256()),salt_length=padding.PSS.MAX_LENGTH),clientCert.signature_hash_algorithm)


But i still get invalid signature error

• You probably want to use a dedicated X.509 validation library for this instead of doing it yourself. – SEJPM Oct 12 '17 at 12:39
• Yes, I'm using this library cryptography.io/en/latest/x509/reference/… – KaramJaber Oct 12 '17 at 12:59
• Note that most certificates are not signed using PSS but rather using PKCS#1 v1.5 – SEJPM Oct 12 '17 at 13:20
• @SEJPM you are right...that was the problem – KaramJaber Oct 12 '17 at 13:35