I'm newbie in the word of TLS, and need some verification about my picture. I can use TLS with 3 or 2 participants:
3 participants: Client, server, CA (certification authority). The CA is where the server's certificate is signed in, or created by a CA comp. The browser trusts in it automatically, because they have some contract with each other. So the browser starts a https connetion to the server. It asks for the certificate. The server sends it, with the public key. The browser checks, if this certificate is signed in any trusted CA? If yes: Check if the certificate is related to the server, and domain? If yes: Then the certificate is valid >> server is the "person" who I wanted to "talk", so it is OK.
2 participants: Only client and server, where the client needs to trust the server's certificate.
- Case 1: Here the client needs to add the server's certificate to the browser manually to allow the connection
- Case 2: Or needs to confirm the certificate througth the browser. This case is the self-signed PKI. Here you can not be sure, who the server is. You can communicate by an encrypted channel, since you use the async encoding, but you can not be sure who you communicate with.
Am I right?