Openssl command to verify authenticity of CA Issuer? And the "magic" behind it? [duplicate]
I am not confident in my understanding of Certificate Authority and signing certificates. I'm wondering how do you verify the authenticity of an issuer when inspecting an entity certificate.
Here's the scenario that I am using to improve my understanding of Certificate Authority and TLS/SSL certificates.
Let's say Alice makes a private key and certificate signing request with these commands:
openssl genrsa -out entity.key 2048
openssl req -new -sha256 -nodes -key entity.key -config entity.cnf -out entity.csr
Alice then emails the entity.csr and entity.cnf to a Certificate Authority organization called AuthorityOfAll.
AuthorityOfAll downloads both entity.csr and entity.cnf. AuthorityOfAll then executes these commands:
openssl genrsa -out root.key 2048
openssl req -x509 -sha256 -nodes -key root.key -subj "/C=CA/ST=ON/O=AuthorityOfAll/CN=CommonNameAuthorityOfAll" -days 3650 -out root.crt
openssl x509 -req -in entity.csr -CA root.crt -CAkey root.key -CAcreateserial -out entity.crt -days 500 -sha256 -extensions v3_req -extfile entity.cnf
AuthorityOfAll then emails entity.crt back to Alice.
Alice runs the command openssl x509 -in entity.crt -text and sees the following results:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
6b:5d:28:ac:b3:84:1e:ae:bd:e0:d4:2b:d5:ed:f3:37:a5:aa:45:57
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = CA, ST = ON, O = AuthorityOfAll, CN = CommonNameAuthorityOfAll
Validity
Not Before: Feb 8 17:30:15 2024 GMT
Not After : Jun 22 17:30:15 2025 GMT
Subject: C = US, ST = VA, L = Charlottesville, O = GalacticEmpire, OU = PizzaDelivery, CN = make.it-so.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (2048 bit)
Modulus:
00:ad:c0:d8:02:9b:d6:80:cc:b8:22:a3:64:d2:9b:
44:bb:8f:7b:7c:08:3f:02:cb:c1:62:55:a4:13:19:
39:d1:34:04:25:4c:85:37:ba:81:93:85:34:24:c0:
6f:e8:30:62:ae:1e:8e:d1:73:a3:28:2c:25:41:ff:
ac:3a:4b:97:61:6b:92:0a:1a:91:70:e5:ab:d5:32:
f3:cd:7f:23:9f:40:bb:e6:8e:46:45:57:2d:1f:a8:
46:30:78:86:1a:e9:5b:36:4b:4c:59:62:8e:ac:d9:
7a:60:51:7e:05:45:cf:37:86:14:04:98:20:c0:b6:
0b:54:38:08:31:2a:76:37:56:ca:49:08:a6:32:60:
27:b7:fc:e6:d6:63:54:a7:f1:4e:29:2a:9b:22:1a:
8a:90:be:f5:7c:f6:c9:e4:6c:f5:6b:2b:3f:c7:60:
80:8c:56:27:f9:73:8c:9b:ee:e4:c4:fc:05:4e:66:
37:b8:57:f5:fb:ff:36:4f:e5:53:3f:13:1a:7f:14:
f9:aa:a2:fa:aa:45:a8:59:37:6f:74:5e:6d:17:be:
a4:9f:6a:8e:95:0c:2f:a1:be:72:82:4a:dd:d6:86:
67:33:1a:ac:11:1a:c2:fa:d2:b3:44:32:c1:87:5a:
70:5e:c1:cf:69:88:e7:72:b4:5e:af:8b:05:72:9f:
6b:c3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:bargain.dentist.com
Signature Algorithm: sha256WithRSAEncryption
15:12:5a:7e:73:32:ef:e6:90:14:95:a3:bd:5e:12:bd:db:a3:
6e:47:46:91:78:33:95:69:b2:df:61:19:0d:2b:0e:a6:9d:61:
a8:f2:63:60:26:bf:8a:26:cf:a2:20:61:9c:73:ce:b0:74:05:
e3:67:db:e3:ce:6a:71:87:4f:aa:f8:00:6e:6c:7d:d8:43:8c:
59:83:11:dd:b9:59:ee:e4:4f:eb:f1:d4:0b:c9:f4:5e:1c:5c:
20:77:ad:7d:e6:38:89:1a:ae:55:28:4f:f2:a3:36:5d:1d:64:
56:cd:e9:cd:99:3f:57:6a:c2:d3:ce:9e:53:df:85:f8:0a:65:
fe:eb:fc:8c:2b:fd:2f:58:bb:fd:a4:9c:3a:61:0a:b6:52:e5:
94:15:e2:5a:f0:ca:40:86:00:0d:d4:90:58:cf:07:4d:2a:5c:
31:17:ba:d9:b2:4c:0d:76:91:da:96:d1:11:5c:8b:ab:8c:b3:
1e:a4:d0:f2:1f:b9:b2:48:1b:71:a2:77:48:ae:5c:4c:a0:80:
64:ee:ba:64:5e:c4:2c:03:8d:8f:3f:72:de:f1:db:17:1a:11:
0d:91:e1:23:e9:b0:c4:9b:65:1a:0c:7a:3c:ce:33:94:4f:10:
2a:a5:71:4d:92:4e:06:3d:c0:a1:e4:9d:40:c1:aa:38:89:f4:
ce:a1:20:56
-----BEGIN CERTIFICATE-----
MIIDqTCCApGgAwIBAgIUa10orLOEHq694NQr1e3zN6WqRVcwDQYJKoZIhvcNAQEL
BQAwVjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAk9OMRcwFQYDVQQKDA5BdXRob3Jp
dHlPZkFsbDEhMB8GA1UEAwwYQ29tbW9uTmFtZUF1dGhvcml0eU9mQWxsMB4XDTI0
MDIwODE3MzAxNVoXDTI1MDYyMjE3MzAxNVowfjELMAkGA1UEBhMCVVMxCzAJBgNV
BAgMAlZBMRgwFgYDVQQHDA9DaGFybG90dGVzdmlsbGUxFzAVBgNVBAoMDkdhbGFj
dGljRW1waXJlMRYwFAYDVQQLDA1QaXp6YURlbGl2ZXJ5MRcwFQYDVQQDDA5tYWtl
Lml0LXNvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK3A2AKb
1oDMuCKjZNKbRLuPe3wIPwLLwWJVpBMZOdE0BCVMhTe6gZOFNCTAb+gwYq4ejtFz
oygsJUH/rDpLl2FrkgoakXDlq9Uy881/I59Au+aORkVXLR+oRjB4hhrpWzZLTFli
jqzZemBRfgVFzzeGFASYIMC2C1Q4CDEqdjdWykkIpjJgJ7f85tZjVKfxTikqmyIa
ipC+9Xz2yeRs9WsrP8dggIxWJ/lzjJvu5MT8BU5mN7hX9fv/Nk/lUz8TGn8U+aqi
+qpFqFk3b3RebRe+pJ9qjpUML6G+coJK3daGZzMarBEawvrSs0QywYdacF7Bz2mI
53K0Xq+LBXKfa8MCAwEAAaNHMEUwDgYDVR0PAQH/BAQDAgOIMBMGA1UdJQQMMAoG
CCsGAQUFBwMBMB4GA1UdEQQXMBWCE2JhcmdhaW4uZGVudGlzdC5jb20wDQYJKoZI
hvcNAQELBQADggEBABUSWn5zMu/mkBSVo71eEr3bo25HRpF4M5Vpst9hGQ0rDqad
YajyY2Amv4omz6IgYZxzzrB0BeNn2+POanGHT6r4AG5sfdhDjFmDEd25We7kT+vx
1AvJ9F4cXCB3rX3mOIkarlUoT/KjNl0dZFbN6c2ZP1dqwtPOnlPfhfgKZf7r/Iwr
/S9Yu/2knDphCrZS5ZQV4lrwykCGAA3UkFjPB00qXDEXutmyTA12kdqW0RFci6uM
sx6k0PIfubJIG3Gid0iuXEyggGTuumRexCwDjY8/ct7x2xcaEQ2R4SPpsMSbZRoM
ejzOM5RPECqlcU2STgY9wKHknUDBqjiJ9M6hIFY=
-----END CERTIFICATE-----
This output cites the Issuer: C = CA, ST = ON, O = AuthorityOfAll, CN = CommonNameAuthorityOfAll.
Alice also has a copy of root.crt (I assume it's reasonabel to expect that a public ca should make root.crt available to everyone?). Alice runs the command:
openssl verify -CAfile root.crt entity.crt
#result
entity.crt: OK
In the whole process above, could Alice have "forged" the signature of AuthorityOfAll? My guess is that when AuthorityOfAll ran the command openssl x509 -req -in entity.csr -CA root.crt -CAkey root.key -CAcreateserial -out entity.crt -days 500 -sha256 -extensions v3_req -extfile entity.cnf, that the resulting entity.crt contains some kind of "data" that relates back to root.pub or root.key , and Alice would not be able to fabricate that "data" without the root.key. If something like this is the case, what commands do I run to verify the authenticity of the Issuer? And maybe a little explanation of the algorithm/math/science behind issuer authenticity?
