How can I validate a given Server-Certificate behind a HTTPS-connection? I know more or less about how TLS works in principle.

But how can I be sure, that the certificate behind a server's web site (e.g. tele-banking from my bank) has been issued to my bank and not to someone else.

Let's say there is a faked tele-banking portal, to which I get connected accidentally. If they got a certificate issued by a CA, everything works and my data are transmitted to the fake site.

So I would have to check the certificate every time I use the portal.
But how? My bank says:


  The Bank XXX login pages are encrypted and therefore begin with
  "https://". Always check the owner of the security certificate, which
  must be "XXX Bank XXX" with the Internet address is
  highlighted in green color prior logon to your OnlineBanking.


Now, virtually everybody can get a signed certificate with owner="UniCredit Bank Austria" from a CA. Does CA-1 know about other certificates issued by any other CA-2? I cannot imagine that this is the case. But how can I be sure, that the certificate I want to rely on is not a fake?
OK, so let's step through this, but first:
CAs have exactly one raison d'être and that is to attest the link between a domain, a public key and optionally an entity.

As an overview, a CA validation of this set of information can go as follows:


You register with the CA, so they can attribute actions made from a specific account to you.
You request validation that your account represents a given entity (this can be a natural person or a legal person like a bank). Note that only validated information will be placed in the certificate.


This may include copies of official documents (passport, driver's license, governmental ID) if you want to validate as a person.
This may include an attestion letter of the CEO of the company.
If you are really interested, read the CA-Baseline Requirements (section 3.2) and the EV-Guidelines (section 11).

You request validation that you control a certain asset (usually a domain).


This means that you have to prove control over the asset, which can be proven by placing a file on a webserver or by clicking on a link sent to an email strongly associated with the domain owner (like the hostmaster entry in the WHOIS database)

You send the CA your public key and they give you a certificate.


This usually uses a PKCS#10 certificate signing request (CSR). Note that CAs keep track of whom they issued which certificate for which domain(s).





So what if a CA doesn't do its job properly? Well if it violates the CA-Baseline requirements or the EV guidelines for an EV certificate, it will be untrusted by the browsers and operating systems and thus can no longer issue default-trusted certificates, ie it is out of business. Historically, this did happen, for example with Diginotar but also with StartSSL and WoSign. They all failed to adhere to the baseline requirements and thus got marked "untrusted" to varying degrees.



Also note that the browser will validate the domain name, the public key and the signature chain of the certificate automatically and will display you an error message if any step of this process fails. So you can trust the fact that the certificate the browser presents you is the right one for the domain you're on.