Encrypted cerficiate signature for server certificate and intermediate certificate in packet capture If we view the certificate chain using Firefox, we can see the certificate signature of "server certificate" and its "intermediate-CA" right after the "certificate signature algorithm" in the certificate field

In the packet capture, this is returned by the server:

1) server certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted (I guess this is the certificate signature, no?)

2) intermediate CA certificate, its public key, its certificate signature algorithm, and followed by some thing encrypted. (I guess this is the certificate signature too, no? )

My question, which key is used to encrypt the certificate signature of "server certificate" and "intermediate CA"?

If server private key is used to encrypt certificate signature for both server certificate and intermediate CA, then server's public key can be used to decrypt and view their certificate signature

If intermediate CA used its own private key to encrypt the certificate signature, then must use the intermediate CA public key to decrypt and view its certificate signature - however, the server will not have the private key of the intermediate CA, then how can this happen? Unless when configuring the certificate chaining in the server, the imported intermediate CA already has the certificate signature encrypted?

Appreciate if someone can shed some light.
The intermediate certificate is signed by its issuer(a root CA or another intermediate CA), using the private key of the issuer's certificate.

The server certificate is signed by the intermediate CA at the lowest level of the certificate chain.


  when configuring the certificate chaining in the server, the imported intermediate CA already has the certificate signature encrypted?


Yes, when you want a certificate for your domain, you ask for it from an intermediate CA. After the CA verifies that you're the actual owner of the domain, they give you a certificate signed by the CA's private key. Then you can configure to use it on your server.

The intermediate certificates are simply available to the public, they are sent by the server generally for clients that don't have them installed.