I have three questions regarding SSL that I don't fully understand.

  1. If I get it correctly, a server A submits a request to a certain CA. Then, it receives (after validation etc.) a digital certificate composed of a public key + identity + an encription of this information using the CA's private key.

    Later on, a client B wants to open an SSL communication with A, so A sends B its digital certificate.

    My question is can't B just take this certificate, thus stealing the identity A - which will allow them to authenticate as A to C, for example. I understand that C will decrypt the certificate with the CA's public key, It will then encrypt its symetric key which will only be decryptable by the real A.

    However, I do not see where authentication comes to play if B can actually steal A's identity. Unless I am missing something.

  2. Second question: Why use hashing on the certificate if a part of it is already encrypted by the CA? Doesn't this mean that no one can mess around with a digital certificate (in high probability) anyway?

  3. If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.

Thank you very much.

ssl
Edit
Report