Suppose that Alice has a certificate CA1 << Alice >> issued by the certification authority CA1, and Bob has a certificate CA2 << Bob >> issued by a different certification authority CA2.
It is known that CA1 possesses a certificate CA2 << CA1 >> issued by CA2. How can Bob validate Alice’s certificate CA1 << Alice >>?
I think CA2 is the root authority but I’m not sure how to proceed with this problem.
As CA2 << CA1 >> is a certificate it seems that CA2 is indeed a root certificate. This is not strictly necessary; CA2 just needs to be trusted by Bob. CA2 << CA1 >> is then an intermediate CA certificate for cross certification.
To verify the certificate you need to verify the certificate chain. So the CA2 certificate is trusted, which verifies CA2 << CA1 >>, which finally verifies CA1 << Alice >>. This is performed by retrieving the public key within the parent certificate of the issuer and then use that to verify the signature of the child certificate of the subject. Besides verifying the signature over the "To Be Signed" part of the certificate you may also need to validate properties such as validity period, key usage and so on.
Generally if there are two separate CA's that need to trust each other then the trust is established by issuing cross certificates: special intermediate certificates that establish the trust. These certificates may have additional properties that establish the type and level of trust. Here is an explanation of the trust relationships, unfortunately without the intermediate certificates being shown.
The cross certification certificate is placed next to the original certificate in the trust chain. So while you have C1, C1 << Alice >> as the original chain you would have another chain C2, C2 << C1 >> (replacing C1) and finally C1 << Alice >>.
