I understand that the role of a Certificate Authority is to SIGN (not encrypt) a certificate. The signed certificate will theoretically contain:
- Plain text of data, including the server's public key
- Signature of hashed version of plain text of data in (1) so that a user can verify (using CA public key) that the certificate has not been tampered with.
Knowing these two key points, I tried to play around with an example cert
-----BEGIN CERTIFICATE-----
MIIF7zCCBNegAwIBAgIRANdVj9r18RBbshMoK3B3KaMwDQYJKoZIhvcNAQEFBQAw
gZcxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtl
IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMY
aHR0cDovL3d3dy51c2VydHJ1c3QuY29tMR8wHQYDVQQDExZVVE4tVVNFUkZpcnN0
LUhhcmR3YXJlMB4XDTExMDMxNTAwMDAwMFoXDTE0MDMxNDIzNTk1OVowgd8xCzAJ
BgNVBAYTAlVTMQ4wDAYDVQQREwUzODQ3NzEQMA4GA1UECBMHRmxvcmlkYTEQMA4G
A1UEBxMHRW5nbGlzaDEXMBUGA1UECRMOU2VhIFZpbGxhZ2UgMTAxFDASBgNVBAoT
C0dvb2dsZSBMdGQuMRMwEQYDVQQLEwpUZWNoIERlcHQuMSgwJgYDVQQLEx9Ib3N0
...
-----END CERTIFICATE-----
I tried decoding using Base64 decoder, and the result is gibberish. I tried googling for answers but I'm not getting anywhere.
- What encoding scheme is this and does this offer extra layer of security?
- Shouldn't the main ideas (point 1 and 2) be secure enough?
- Is there a way I can break this blob down to visually show that data part and the signature part?
openssl x509 -in name-of-cert-file -noout -text
will give you a human readble version of the certificate $\endgroup$ – Matt Caswell Jan 10 '20 at 14:48