Imagine that we have an x509 cert (if it matters, in .pem format) and a key supposed to certified with it.
How can I validate, that the cert certifies exactly that key?
My impression is that it is enough to examine that the cert and the key have the same pub key. I think it is because this is the only shared information between them. However, I am not sure.
Is it enough?
What happens if a possible attacker, having access to the cert, simply re-writes the pubkey part in it?
(Note, the validation of the cert is a different thing. Here I only want to be sure, that the cert certifies exactly that key.)