As far as I know,
when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key.
The digital signature is data that was created (not encrypted!) by their
private key over my
Now, a client connects to my site (which has an SSL certificate).
- He reads the digital signature (from the certificate)
- He knows which algorithm used to create this signature, and he runs the hash again over my certificate data
- Client uses his public key (in his store) of Verisign to decode (not decrypt) the digital signature
- If there is a match - all fine.
- Client generates a random number, encrypts it with my public key, and my server accepts it and from now on - we are in symmetric mode.
I have the following questions:
Was I right?
Verisign creates the digital signature over my certificate data - which data?
The digital signature was created by what operation(?) over my certificate data? (Is this hashing?)
(I am not a cryptographer, but a programmer who wants to understand this stuff.)