title: How does a ROOT CA verify a signature?
body: <p>Say when using https, browser makes a request to the server and server returns its certificate including public key and the CA signature. </p>
  
  <p>At this point, browser will ask its CA to verify if the given public key really belongs to the server or not? </p>
  
  <p>How is this verification done by the Root cert on the browser? </p>
  
  <p>To give an example: 
  Say serverX obtained a certificate from CA "rootCA". Browser has a copy of rootCA locally stored. When the browser pings serverX and it replies with its public key+signature. Now the root CA will use its private key to decrypt the signature and make sure it is really serverX? </p>
  
  <p>is it how it works?</p>