0

The client receives a webserver certificate, that contains a public key "ABC" and identification "DAVID" of the website owner.

Then i am not sure what happens. The browser has to somehow verify, that the certificate is from the user "DAVID". So what happens next? I would surmize, that the browser holds some CA certificates as well.

The browser looks up, whether it can find the public key "ABC" website certificate. If it matches, then the public key can be used to verify, that the website certificate is valid.

Is this correct?

Improve this question
4
  • 2
    Your operating system holds what are known as "root certificates" and there are also certificate authorities that can be used to find out if certificates are legitimate or have been revoked.
    – Mokubai ♦
    Dec 31, 2021 at 17:20
  • 1
    The client (browser) verifies the server (SSL certificate) is legitimate not the other way around.
    – Ramhound
    Dec 31, 2021 at 17:39
  • @Mokubai i thought the browsers have the root the certificates, but it is actually the operating system, that holds it?
    – David
    Dec 31, 2021 at 17:48
  • 2
    @David - Except for Firefox, yes, the OS certificate store is used
    – Ramhound
    Dec 31, 2021 at 18:02

1 Answer 1

Reset to default
1

The client receives a webserver certificate, that contains a public key "ABC" and identification "DAVID" of the website owner.

The browser has to somehow verify, that the certificate is from the user "DAVID". So what happens next?

TLS certificates aren't used to identify website owners – they identify the websites themselves. The certificate used by superuser.com says "this is superuser.com" and the browser compares it to the URL that you entered.

Although they do often include organization information, that's not actually used by browsers for verification – it's only there to be shown to the user. Many websites use "domain-validated" certificates which include no organization details at all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .