Four implications follow:
-
Because the certificate contains the subjects's public key, the certificate and the private key together are all that is needed to encrypt and decrypt.
-
To verify certificates, you need the certificates of all CAs you trust.
-
The simplest form of a dummy-certificate is one that is signed by the subject.
-
A CA is needed. The client can't simply issue local certificates for servers it trusts because the server determines which certificate it presents.
