How are hash functions used in digital signatures, and how does this work with X.509 certificates?

Instead of signing the entire document (slow with asymmetric crypto), you hash it first and sign only the small fixed-size hash — the hash serves as a proxy.

* The sender signs the digest with the private key; the receiver re-hashes and checks it with the public key. *

Digital signature process:

1. Sender: Hash the document → get a fixed-size digest (e.g., 256 bits)
2. Sender: Sign the hash with their private key → digital signature
3. Transmit: Send document + signature
4. Receiver: Hash the received document independently
5. Receiver: Verify the signature with sender's public key → compare hash values
6. If hashes match: authentic (to 99.99...% certainty). If they don't: 100% forged.

* A CA hashes the certificate fields, signs that digest with its private key, and records the scheme in the signatureAlgorithm field. *

In X.509 certificates:

• The certificate contains: subject, public key, issuer, validity, extensions...
• The issuer (CA) hashes all these fields with a Hash Function (e.g., SHA2-256)
• The CA signs this hash with its private key
• The signatureAlgorithm field specifies which combination was used (e.g., SHA2-256 with RSA)

Why hash first? Asymmetric operations (RSA, ECC) are extremely slow. Hashing reduces any document to 256 bits, making the signature operation fast and constant-time regardless of document size.

Go deeper:

• Digital signature (Wikipedia) — the sign-with-private, verify-with-public scheme and its security guarantees.
• X.509 (Wikipedia) — certificate structure and how the CA's signature chains trust.