1. curious, why the client needs to save a root certificate
In SSL, there are client, server, CA Certification Center (an agency)
First determine a tone, the client is fully trusted CA Certification Center. CA Certificate Authority server to send a digital certificate, CA Certification Center, said trust server, then the final, client download a digital certificate from the server, go to CA Certification Center check (check, CA Certification Center whether to trust the server).
Kefuduan trust the CA Certification Center, CA trusted Certificate Authority server, the client trusts the server. Then this is a chain of trust.
2. These are the basic principles, it is more complicated to implement specific
Client certification process:
(1) server generates a pair of keys, a private key in my possession, to the public Certificate Authority (CA)
(2) CA for review, and to generate a digital signature with a public key of your own CA private key provided by the server certificate
(3) connection is established the client, the client obtains from the server a digital certificate, to verify the CA's public key with a digital certificate (root certificate), compared to the same, indicating that the certificate was actually issued by the CA (this too Conclusion there is a premise is this: the client's public key is really CA CA's public key, private key that is, the CA's public key and the public key server provided by CA to sign indeed a pair), while CA and as authority. ensure that the public key really is to provide a server-side, so you can verify that the certificate is indeed a legitimate public key server provides.
To ensure the prerequisites mentioned in step 3, CA's public key must be safely transferred to the client (CA root certificate must be installed on the client side), therefore, CA's public key in general by the browser developers built-in internal browser. Thus, the prerequisite of trust on a variety of mechanisms to guarantee the basic set up.
3. To sum up the above
CA Certification Center has a root certificate, is the starting point of the chain of trust, is that we all believe CA Certification Center.
Client download from the CA root certificate authentication center.
CA Certification Center gave the server a digital certificate.
When a client connection to the server, download the digital certificate.
Digital certificates do not equal the root certificate.