= TLS Signatures =

A TLS Certificate is composed of:

* The certificate body, which contains a bunch of fields, including:
 * Information identifying the host
 * The public key of the host
 * Information identifying the signing CA
 * The Signature Algorithm
 * etc.
* The Signature

The Signature is just the body of the certificate, which has been:
* Hashed by the hash specified in the Signature Algorithm
* Encrypted by:
 * The cipher specified in the Signature Algorithm
 * The private key of the CA that issued it

For example, if the Signature Algorithm is sha1WithRSAEncryption, then the signature was generated by:
* Hashing the certificate body using the SHA1 algorithm
* Encrypting the result using:
 * The RSA algorithm
 * The private key of the issuing CA

To validate the certificate:
* The signature is decrypted using:
 * The cipher specified in the Signature Algorithm
 * The public key provided by the CA cert of the signing CA
* The certificate body is hashed by the hash specified in the Signature Algorithm
* The result is compared to the decrypted signature

The certificate is deemed valid if:
* The decrypted Signature matches the hash of the certificate body
* The CA cert of the signing CA is valid

To determine if the CA cert of the signing CA is valid, the same process is repeated for the CA cert, its CA cert, its CA Cert, and so on, until a Root cert is encountered.

To validate the Root cert, its Signature is just decrypted using its own public key.  If its decrypted Signature matches the hash of its certificate body, then the Root cert is presumed valid.
