# How can Bob validate Alice’s certiﬁcate?

Suppose that Alice has a certiﬁcate CA1 << Alice >> issued by the certiﬁcation authority CA1, and Bob has a certiﬁcate CA2 << Bob >> issued by a diﬀerent certiﬁcation authority CA2.

It is known that CA1 possesses a certiﬁcate CA2 << CA1 >> issued by CA2. How can Bob validate Alice’s certiﬁcate CA1 << Alice >>?

I think CA2 is the root authority but I’m not sure how to proceed with this problem.

As CA2 << CA1 >> is a certificate it seems that CA2 is indeed a root certificate. This is not strictly necessary; CA2 just needs to be trusted by Bob. CA2 << CA1 >> is then an intermediate CA certificate for cross certification.
To verify the certificate you need to verify the certificate chain. So the CA2 certificate is trusted, which verifies CA2 << CA1 >>, which finally verifies CA1 << Alice >>. This is performed by retrieving the public key within the parent certificate of the issuer and then use that to verify the signature of the child certificate of the subject. Besides verifying the signature over the "To Be Signed" part of the certificate you may also need to validate properties such as validity period, key usage and so on.
The cross certification certificate is placed next to the original certificate in the trust chain. So while you have C1, C1 << Alice >> as the original chain you would have another chain C2, C2 << C1 >> (replacing C1) and finally C1 << Alice >>.