In HTTP The Definitive Guide
When you establish a secure web transaction through HTTPS, modern browsers automatically fetch the digital certificate for the server being connected to. If the server does not have a certificate, the secure connection fails.
When the browser receives the certificate, it checks the signing authority. If it is a public, well-respected signing authority, the browser will already know its public key (browsers ship with certificates of many signing authorities preinstalled), so it can verify the signature as we discussed in the previous section, “Digital Signatures.” If the signing authority is unknown, the browser isn’t sure if it should trust the signing authority and usually displays a dialog box for the user to read and see if he trusts the signer. The signer might be the local IT department, or a software vendor.
How does a browser check the signing authority, after receiving a certificate from a server?
Does the browser need to get the public key from the signer, in order to verify the server certificate?
Are public keys of CAs and server certificates of servers stored separately?
Does the browser permanently store the received server certificate somewhere, or delete them after the HTTP session or some expiration date?
If the computer which runs the browser also run a web server to host some web applications using HTTPS and server certificates, are those server certificates for the locally hosted web applications and the server certificates received by the local browser stored separately?
In Using Curl to Automate HTTP Jobs:
curl also tries to verify that the server is who it claims to be, by verifying the server's certificate against a locally stored CA cert bundle. Failing the verification will cause curl to deny the connection. You must then use --insecure (-k) in case you want to tell curl to ignore that the server can't be verified.
At times you may end up with your own CA cert store and then you can tell curl to use that to verify the server's certificate:
curl --cacert ca-bundle.pem https://example.com/
How does curl check the signing authority?
Is "verifying the server's certificate against a locally stored CA cert bundle
ca-bundle.pem
" how curl checks the signing authority?What is inside a locally stored CA cert bundle
ca-bundle.pem
?(I guess the bundle doesn't contain server certificates, because curl fetches server certificates directly from servers.)If the computer which runs curl also run a web server to host some web applications using HTTPS and server certificates, are those server certificates for the locally hosted web applications and the locally stored CA cert bundle used by the local curl stored separately?
Thanks.