Something confusing about digital certificates <p>A digital certificate is a digital document that certifies that a certain public key is owned by a particular user. Thus if you trust the CA that signed the certificate <code>C</code>, then you can trust that specific public/private key pair is owned by the owner of certificate <code>C</code>.</p> <p>a) Assume client <code>A</code> wants to establish a connection with server <code>B</code> located at url www.some_domain.com. When establishing a connection with <code>B</code>, <code>A</code> may receive from the other end a X.509 certificate <code>C</code> and a public key, belonging to the owner of certificate <code>C</code>. </p> <p>But how can client know that owner of <code>C</code> is really a server <code>B</code> and not some other entity that hijacked ( if that is the correct term ) the connection and sent its own certificate and public key to <code>A</code>? </p> <p>Only way I can think of for client to know whether owner of <code>C</code> is really <code>B</code>, is if <code>C's Subject</code> field also specifies the domain for which this certificate is valid or if it specifies the organization to which this certificate belongs ( but that only helps if client knows to which organization www.some_domain.com belongs )?! </p> <p>thank you</p>