CertificateVerify

CertificateVerify is a TLS/DTLS handshake message used to prove possession of the private key corresponding to a certificate presented during the handshake. It serves as part of certificate-based authentication, helping to confirm that the entity claiming a certificate actually controls the corresponding private key.

How it works: after the relevant certificate is exchanged, the party that possesses the private key signs a transcript of the handshake or a transcript-derived digest using the private key and a negotiated signature algorithm. The resulting signature is sent in the CertificateVerify message, along with the identifier of the algorithm used. The recipient validates the signature with the public key contained in the peer’s certificate, binding the peer’s identity to the possession of the private key.

Variants by protocol version: in TLS 1.2, CertificateVerify is typically sent by the client only when the server requests client authentication. In TLS 1.3, the CertificateVerify message is used in the context of certificate-based authentication on the side that has a certificate to prove possession of its private key; this can apply to either client or server authentication depending on configuration.

Content and validation: the CertificateVerify message does not carry the certificate itself; rather, it carries a digital signature and the chosen signature algorithm. Validation requires access to the corresponding public key from the peer’s certificate and checks that the signature correctly signs the negotiated handshake data.

Security considerations: CertificateVerify relies on the integrity of the private key and the strength of the signing algorithm. Compromise of the private key or misconfiguration of allowed algorithms can undermine handshake security and enable impersonation. Proper certificate management and protocol version configuration are essential.