How are Digital Certificates authenticated?

Question

I am trying to understand Digital Certificates and Public Key Cryptography and reading this page. Quoting from..

In addition, digital certificates rely on public key cryptography for their own authentication. When a digital certificate is issued, the issuing certification authority signs the certificate with its own private key. To validate the authenticity of a digital certificate, a user can obtain that certification authority's public key and use it against the certificate to determine if it was signed by the certification authority.

I do not understand what is meant by

When a digital certificate is issued, the issuing certification authority signs the certificate with its own private key.

and therefore I also fail to understand

To validate the authenticity of a digital certificate, a user can obtain that certification authority's public key and use it against the certificate to determine if it was signed by the certification authority.

What is meant by signing the certificate by own private key? Does it mean encrypting the certificate with the private key?

My knowledge is, one can encrypt a piece of data with a given public key, and the private key can then be used to decrypt the encrypted data.

But if the Authority encrypts the data with private key, how does the user authenticate it with the public key? Can a public key decrypt the data encrypted (signed) with the private key?

Answer 1

With RSA, it is the case that messages encrypted with the private key can be decrypted with the public key, as well as vice versa. But that's not the case with all public key encryption, and is not required for digital signatures. What's required is that there is some pair of algorithms one of which can produce a signature using a private key and the other one of which can verify the signature using the matching public key. The exact implementation details of those algorithms are different for different protocols.

Answer 2

What is meant by signing the certificate by own private key? Does it mean encrypting the certificate with the private key?

No, it really means signing.

My knowledge is, one can encrypt a piece of data with a given public key, and the private key can then be used to decrypt the encrypted data.

That's correct, but incomplete. Encryption/decryption isn't the only operation that's possible using public-key cryptography.

Making/verifying a digital signature is completely distinct from that. They both generally involve a "public + private" pair of keys, but that's where the similarity ends.

In some algorithms such as RSA, the math involved in signing and encryption is almost the same – but that is an exception, not the rule.

But if the Authority encrypts the data with private key, how does the user authenticate it with the public key? Can a public key decrypt the data encrypted (signed) with the private key?

Yes, a public key can verify data signed with the private key. If the verification succeeds, it proves that the signature was really made by the private key.