After reading many articles and watching many tutorials I decided to be specific because there are some things about **SSL certificate chain verification** and **SSL cetificate verification in general** that I couldn't verify against all the tutorials I have read nor the ones I watched.

**CASE 1:**

Let me take a case where I own a certificate from **Verisign**, after the verification process they gave me a public/private key pair.

My server sends the public key(my certificate) to the browser, the browser own a copy of **Verisign** public key.

The following questions may seem stupid, but there isn't consistency among tutorials and everytime I try to understand I got myself into another corner.

* How will the browser with **Verisign** public key is going to identify that **my public key** is indeed a valid **Verisign** key that can be used for encrypting messages that my **Verisign** private key can decrypt?, I assume its the **Verisign** public key **digital signature** that is tested against the server **public key digital signature**?, **I may be wrong**, but even if I am right I will be glad for a bit of clarification.
* In case its indeed the **digital signature** that is tested I assume there is a relationship between all of **Verisign** public keys?, or maybe there is only relationship between each **public key Verisign** assign to a specific client(website/device/etc) and the public key the browser/operating system including.

**CASE 2:**

Intermediate certificates.

* I understand that the need for them is [security](https://support.globalsign.com/customer/portal/articles/1217450-overview---intermediate-root-certificates), so the root CA private key can stay offline, if there are more reasons i'll love to hear about them.
* About the chain verification, I assume the server public key **digital signature** is tested against the server **intermediate certificate digital signature**, if its valid now it is the turn for the **intermediate certificate digital signature** to be tested against the **browser/operating system pre-installed public key digital signature**, and if this is also valid, the client has successfully validate both the intermediate certificate and the public key of the server.

**I know i probably missed all up, if anyone can help me straight things up I will be very thankful.**