title: What is a real world example of how Diane's browser looks to see if it trusts the CA in a PKI?
body: <p><strong>PKI Question</strong></p>
  
  <p>I am trying to learn about Public Key Infrastructure (PKI). I read the following example from a book for how two users can participate in a PKI. The only part I do not understand is step #10 "When Diane receives John’s certificate, her browser looks to see if it trusts the CA that digitally signed this certificate. Diane’s browser trusts this CA and, after she verifies the certificate, both John and Diane can communicate using encryption.". What is a real world example of how Diane's browser looks to see if it trusts the CA? I thought Diane would only be accessing a web server through her browser not an end user like John. </p>
  
  <p><strong>PKI Example from Book</strong></p>
  
  <p>Now that the fundamentals of PKI are understood, let’s walk through an example. Suppose John needs to obtain a digital certificate for himself so he can participate in a PKI. The following are the steps to do so:</p>
  
  <ol>
  <li>John makes a request to the RA.</li>
  <li>The RA requests certain identification information from John, such as a copy of his driver’s license, his phone number, his address, and other identifying information.</li>
  <li>Once the RA receives the required information from John and verifies it, the RA sends his certificate request to the CA.</li>
  <li>The CA creates a certificate with John’s public key and identity information embedded. (The private/public key pair is generated either by the CA or on John’s machine, which depends on the systems’ configurations. If it is created at the CA, his private key needs to be sent to him by secure means. In most cases, the user generates this pair and sends in his public key during the registration process.</li>
  <li>Now John is registered and can participate in a PKI.</li>
  <li>John and Diane decide they want to communicate, so they take the following steps.</li>
  <li>John requests Diane’s public key from a public directory.</li>
  <li>The directory, sometimes called a repository, sends Diane’s digital certificate.</li>
  <li>John verifies the digital certificate and extracts his public key. John uses this public key to encrypt a session key that will be used to encrypt their messages. John sends the encrypted session key to Diane. John also sends his certificate, containing his public key, to Diane.</li>
  <li>When Diane receives John’s certificate, her browser looks to see if it trusts the CA that digitally signed this certificate. Diane’s browser trusts this CA and, after she verifies the certificate, both John and Diane can communicate using encryption. </li>
  </ol>