Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора, Страница: 484 / 512

Appendix B. Introduction to Public-Key Cryptography
464
Figure B.7. Example of a Certificate Chain
A certificate chain traces a path of certificates from a branch in the hierarchy to the root of the
hierarchy. In a certificate chain, the following occur:
• Each certificate is followed by the certificate of its issuer.
• Each certificate contains the name (DN) of that certificate's issuer, which is the same as the subject
name of the next certificate in the chain.
In
Figure B.7, “Example of a Certificate Chain”
, the
Engineering CA
certificate contains the DN
of the CA,
USA CA
, that issued that certificate.
USA CA
's DN is also the subject name of the next
certificate in the chain.
• Each certificate is signed with the private key of its issuer. The signature can be verified with the
public key in the issuer's certificate, which is the next certificate in the chain.
In
Figure B.7, “Example of a Certificate Chain”
, the public key in the certificate for the
USA CA
can
be used to verify the
USA CA
's digital signature on the certificate for the
Engineering CA
.
B.4.6.3. Verifying a Certificate Chain
Certificate chain verification makes sure a given certificate chain is well-formed, valid, properly signed,
and trustworthy. The following procedure is used to form and verify a certificate chain, starting with the
certificate being presented for authentication: