我有X.509格式的证书，由根CA签名。我也有根CA的公钥。现在我想手动验证证书是否合法。
我理解的是，在签署证书时，它的哈希是用sha256算法计算的，我可以在下面的证书中看到，然后用RSA加密。我可以解密它以查看哈希值，然后生成我自己的哈希值进行比较吗？这是验证证书的完整过程吗？或者我必须做点别的事情？
直到现在我能做的是从rootCA中提取公钥;
openssl x509 -pubkey -noout -in rootCA.crt > rootCAkey.pem
并解密数据;
openssl rsautl -decrypt -inkey rootCAkey.pem -keyform PEM -pubin -in device.crt > data
但我收到A private key is needed for this operation的错误。为什么我需要私钥才能解密？
原始证书：
D:\Examples>openssl x509 -in device.crt -text -noout
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
a9:d8:71:db:17:18:f3:c2
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=UK, ST=England, O=OBI Limited, OU=CA /emailAddress=info@obi.org
Validity
Not Before: Aug 18 09:08:35 2017 GMT
Not After : Dec 31 09:08:35 2018 GMT
Subject: C=UK, ST=London, O=IKEEA, OU=Cutlery, CN=localhost/emailAddress=local
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:de:5c:ae:42:e1:b6:16:fe:dd:6e:8b:08:6a:eb:
29:d1:8b:a3:2a:b9:63:0a:01:29:48:1c:c1:d0:2d:
31:50:50:6e:17:92:a5:9a:52:fe:ac:4c:c7:64:36:
24:28:79:f5:79:0f:54:79:5d:e3:a8:42:56:91:94:
bf:df:01:8f:1a:db:41:e7:19:2a:06:af:46:0a:5b:
eb:be:ff:10:95:cd:0a:9d:5b:3c:d0:ac:3d:a8:02:
10:c0:21:7d:0b:91:10:f4:17:dd:89:52:52:ec:34:
43:03:84:7e:01:49:70:d3:cd:15:3a:ba:f1:ec:32:
b5:61:4f:f4:00:14:0d:30:ee:58:67:11:23:be:b2:
41:2a:c6:a6:fe:bc:3d:86:87:aa:2a:0f:13:19:03:
87:40:cc:3b:3a:5c:f0:cc:2a:89:36:a6:56:4f:84:
d0:df:36:32:87:eb:94:4e:b4:11:d8:4f:fc:c9:67:
fb:53:0d:e0:fe:99:e5:13:29:fd:9c:3c:d0:2b:95:
d7:fc:e0:b0:f7:73:68:4d:c3:7a:56:cb:2c:ba:b2:
f1:e2:88:0f:11:3d:22:4e:52:d4:26:cd:39:62:44:
a7:24:57:d8:a0:05:bb:50:31:e4:ce:fa:3e:ad:82:
c9:83:60:93:e6:88:51:b7:99:47:56:8e:8e:fe:26:
0d:53
Exponent: 65537 (0x10001)
Signature Algorithm: sha256WithRSAEncryption
59:b0:de:3e:51:36:29:0b:95:4a:92:39:10:ea:ba:58:fc:3e:
46:97:07:f8:18:a8:33:4e:d4:dc:8b:43:f3:6e:49:a2:f4:f2:
d8:19:a5:9b:88:db:d0:a2:de:12:a3:9f:9f:f9:6b:31:b4:75:
b9:ee:d7:d5:d8:56:eb:11:71:9e:7a:86:db:17:74:33:d4:19:
31:be:34:61:b9:4e:61:fa:ab:bd:12:5b:64:ea:a6:9f:79:a8:
ae:13:cb:ce:5e:4b:44:ee:d3:d4:e0:e9:9a:b2:70:d4:7b:e3:
c7:30:e5:77:c9:48:be:e6:57:ca:32:ef:d4:08:67:fa:e3:65:
a2:12:ae:8c:fb:7a:d6:dc:5b:1a:63:6e:3a:84:b6:a2:5c:4f:
84:1c:2e:ec:55:31:69:59:b2:10:8f:ed:fc:e5:b1:d5:cf:1b:
41:ae:2a:3d:da:37:28:0a:c6:46:32:a2:d6:8a:1f:cb:7a:59:
f8:eb:fc:22:c3:c5:91:41:92:63:c1:78:59:89:4c:80:f8:f8:
63:12:86:37:97:ec:26:44:cf:65:4d:b5:c2:79:6b:1d:6a:8b:
ff:49:06:83:a7:2a:57:e3:a7:d2:00:65:ca:da:5e:99:e9:07:
98:aa:9e:d3:21:e9:30:6e:b8:85:78:bb:7c:49:e3:1d:0b:4f:
13:06:b8:09