Original thread: Why hash the message before signing it with RSA?
Please correct the diagram below so I can better understand how certificates are created and signed by a third party CA:
The CSR (which contains the RSA public key, Subject Name (CN), etc) is hashed+padded then encrypted by the third party CA. Then the same original CSR (or just "certificate") is then combined together with the certificate signature to produce the digitally signed SSL certificate?
Added comment 2018-05-26:
Thanks for the response, I appreciate you taking the time to discuss this.
"The signature of the CSR - which is also signed - is by the private key that is part of the key pair of which the public key is within the CSR. This signature value is verified and disposed." How does the CSR signing work? Does it use SHA to hash the CSR contents and then encrypt the hash using a temporary private key that was created by the web server during the CSR generation?
How does the CSR signature verification work? Does the CA decrypt the encrypted hash value of the CSR and then verify that the hash values are identical, at which point the CSR signature is verified and disposed of?
"It is not possible to encrypt with a private key because anybody can "decrypt" with the public key; the private key is used for RSA modular exponentiation though."
When does RSA modular exponentiation occur (when calculating the padding)?
Here is a revised diagram for your review: