I have been searching for a detailed explanation but can’t seem to find a low level one.
1) When CA sign the data with its private key, the encrypted data is APPENED to the csr or the whole cert itself is the encrypted version? Does the encrypted data include contain public key or the whole CSR is encrypted?
2) if it is appended, why do we still need to keep original data in the cert? To check that data has not been altered when signature is unlocked by CA public key? Why can’t we just unlock CA signature and use the data inside there?
3)if it is replaced, how do we know which CA does this certificate belongs to?
4) does the client rely on IssueBy field to know which CA public key to use or they just try all the public