The encrypted digest is called a "digital signature," and when placed into the X.509 certificate, the certificate is said to be "signed." The CA keeps its private key very secure, because if ever ...

If it is not, you will see a message like one of the following: "The digital signature on this message can't be verified. This message has a digital signature, but it wasn't verified because the ...