title: Decryption with public key returns incorrect value
body: <p>I'm trying to understand how certificate's signature works in more detail.</p>
  <p>I've got:</p>
  <ol>
  <li>Root self-signed certificate and its public key.</li>
  <li>User certificate that has been signed by the root.</li>
  </ol>
  <p>I wrote some code that is supposed to verify that the user signature is correct (that the certificate has been issued by the root). <code>usrCer</code> and <code>rootCer</code> are of type <code>X509Certificate</code>.</p>
  <pre><code>String hashThatWasSignedByIssuer = DigestUtils.sha256Hex(usrCer.getTBSCertificate());
  String decryptedHash = decryptByPublicKey(usrCer.getSignature(), rootCer.getPublicKey());
  
  System.out.println(hashThatWasSignedByIssuer);
  System.out.println(decryptedHash);
  
  public static String decryptByPublicKey(byte[] cipherBytes, PublicKey publicKey) throws InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException, BadPaddingException, IllegalBlockSizeException
  {
          Cipher cipher = Cipher.getInstance(&quot;RSA/ECB/PKCS1Padding&quot;);
          cipher.init(Cipher.DECRYPT_MODE, publicKey);
          byte[] plainBytes = cipher.doFinal(cipherBytes);
          return DigestUtils.sha256Hex(plainBytes);
  }
  </code></pre>
  <p>From what I found on the Internet, the tbs part of the certificate is hashed and consequently signed by the issuer. The hash is encrypted with the private key of the issuer, so in <code>decryptByPublicKey()</code> I try to decrypt it.</p>
  <p>However, when I run the program I get different hashes:</p>
  <pre><code>7fc90d422ddfd611ea1aa5f3b66b43c598762c587d39f127a8a9203dc8f2cf1d
  80e581c503d80e39989eef835aa83c9be3083cb3675b259f20bb0b829124f579
  </code></pre>
  <p>Why is so?</p>
  <p>The algorithms and signature are:</p>
  <ol>
  <li>User - <code>RSA Encryption (2048 bits)</code>, signature alg <code>sha256WithRSAEncryption</code>, signature - 512 bytes.</li>
  <li>Root self-signed <code>RSA Encryption (4096 bits)</code>, signature alg <code>sha256WithRSAEncryption</code>, signature - 512 bytes.</li>
  </ol>
  <p>Basically what I'm trying to do is to implement my own <code>X509Certificate.verify(PublicKey publicKey)</code> but as simple as possible.</p>
  <p>Any help is greatly appreciated.</p>