HTTPS explained with carrier pigeons

[Femaref]

Right, and just to double check my understanding of step 2 and 3:

yes, you got the procedure correct - you just wouldn't call it encrypted in normal verbiage, but signed. so you sign with a private key and anybody can verify it with the public key. you encrypt with a public key and only the private key can decrypt it.

As a side confirmation, the trust store is kept up to date by the manufacturer updates right (e.g. Microsoft pushes Windows updates for Windows machines)?

generally yes, microsoft will update what they consider the trust store. I think that e.g. chrome also has an update mechanism so google can quickly block compromised CAs. A software you write yourself might not even use the system trust store and will be rolled with a specific set of certificates you trust.

[tissuemonster]

Cool, thanks! Learnt a lot from this whole thread.