Managing trust, X.509 certificate formats, certificate chains, and revocation validation.

1. X.509 Certificate Fields

2. The Certificate Chain of Trust

How browsers trust certificates by tracing them back to built-in Root CAs.

+------------------------+
|   Root CA Certificate  | -> Built into browser/OS trust store. Self-signed.
+------------------------+
           | Signs
+------------------------+
| Intermediate CA Cert   | -> Signed by Root. Used to sign leaf certs to protect root.
+------------------------+
           | Signs
+------------------------+
|   Leaf Certificate     | -> Installed on the web server (e.g., c-note.io).
+------------------------+

3. Certificate Revocation: CRL vs. OCSP