I've been working on the topic of certificates for a little while, and here is what I understand:
- A certificate is basically a public key + some data about the owner of the certificate + a signature made by the private key of the owner
- When a client wants to communicate with a server, the server sends him its certificate, and so the client is able to ensure that he is communicating with the server
- A server's certificate is supposed to be signed by a certification authority trusted by the client. That means that the server is trusted by someone the client trusts. If we assume that the trust is transitive, that implies the client trusts the server.
I'm OK with that if the CA has investigated the server, and then it is legitimate to tell that the server it is trustworthy.
But I saw that some CAs give certificates automatically (e.g. Let's Encrypt). Then I am wonder how the CA can ensure the server is trustworthy...
Is there something I missed ?