How does the signature in a digital certificate come from?

2
votes

According to here:

A digital certificate contains:

  • Serial Number: Used to uniquely identify the certificate.

  • Subject: The person, or entity identified.

  • Signature Algorithm: The algorithm used to create the signature.

  • Signature: The actual signature to verify that it came from the issuer.

  • Issuer: The entity that verified the information and issued the certificate.

  • Valid-From: The date the certificate is first valid from.

  • Valid-To: The expiration date.

  • Key-Usage: Purpose of the public key (e.g. encipherment, signature, certificate signing...).

  • Public Key: The public key.

  • Thumbprint Algorithm: The algorithm used to hash the public key certificate.

  • Thumbprint (also known as fingerprint): The hash itself, used as an abbreviated form of the public key certificate.

My question is, how does the signature come from? I think it is used to ensure the digital certificate is issued by a trusted issuer. So the issuer use its private key to sign on something to produce the signature, then the verifier of the certificate must have the corresponding public key of the issuer to decipher the signature and verify that this something is genuine.

If I am correct, this something must be stored in the certificate as well for the verifier to compare the deciphered signature to. So what's this something? Could it be the thumbprint (hash) of the public key?

1
encryptioncertificatepublic-key-encryptiondigital-certificatepki

1 Answers

5
votes

This something is most of the certificate itself. The receiver can calculate the hash over the TBSCertificate (the part of the certificate To Be Signed) itself using the algorithm in the certificate. The receiver can then verify that it is the same as the hash calculated by the signer (the issuer of the certificate). If the signature is verified and the signer is trusted, then the certificate is verified.

There are more tests to be performed such as validating that the certificate has not been revoked or over it's date of expiry before it can be fully trusted.

A digital certificate consists of:

  1. certificate information
  2. signature algorithm
  3. signature value

See the RFC 5280 for more info on the exact structure of the certificate.