Question: I have three questions regarding SSL that I don't fully understand.

1. If I get it correctly, a server `A` submits a request to a certain CA. Then, it receives (after validation etc.) a digital certificate composed of a public key + identity + an encription of this information using the CA's private key.

Later on, a client `B` wants to open an SSL communication with `A`, so `A` sends `B` its digital certificate.

My question is can't `B` just take this certificate, thus stealing the identity `A` - which will allow them to authenticate as `A` to `C`, for example. I understand that `C` will decrypt the certificate with the CA's public key, It will then encrypt its symetric key which will only be decryptable by the real `A`.

However, I do not see where authentication comes to play if `B` can actually steal `A`'s identity. Unless I am missing something.
2. Second question: Why use hashing on the certificate if a part of it is already encrypted by the CA? Doesn't this mean that no one can mess around with a digital certificate (in high probability) anyway?
3. If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.

Thank you very much.

Answer: 
> 
> My question is can't "B" just take this certificate, thus stealing the identity of "A" - which will allow them to authenticate as "A" to "C"
> 
> 
> 

There's also a private part of the certificate that does not get transmitted (the private key). **Without the private key, B cannot authenticate as A.** Similarly, I know your StackOverflow username, but that doens't let me log in as you.

> 
> Why use hashing on the certificate if a part of it is already encrypted by the CA? 
> 
> 
> 

By doing it this way, anyone can verify that it was the CA who produced the hash, and not someone else. This proves that the certificate was **produced by the CA, and thus, the "validation etc." was performed.**

> 
> If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.
> 
> 
> 

It depends on the particular case, but you will likely have identical certificates on each.
Question N°1
------------

> 
> can't B just take this certificate [...] which will allow them to authenticate as A to C
> 
> 
> 

This [part](http://i.imgur.com/jrUIZOn.png) of the a larger [diagram](http://i.imgur.com/5T2fJsG.png) deals with that question.

Mainly : if you only have the public key then you can not establish an SSL connection with any client because you need to exchange a secret key with them and that secret key has to be encrypted using your public key, which is why the client asks for it in the first time. The client is supposed to encrypt the shared secret key with your public key and you are supposed to decrypt it using your private key. Since you don't have the private key, you can't decrypt the secret exchange key, hence you can't establish any SSL communication with any client.

Question N°2
------------

> 
> Why use hashing on the certificate if a part of it is already
>  encrypted by the CA?
> 
> 
> 

This is also answered in the [original diagram](http://i.imgur.com/5T2fJsG.png) by the question "what's a signature ?". Basically, we're hashing the whole certificate to be sure that it hasn't been tampered with (data integrity), that nobody has changed anything in it, and that what you see is really what was delivered by the CA. The diagram shows how hasing makes that possible.

Question N°3
------------

> 
> If I am stackoverflow and I have 3 servers [...] do I have to have a
>  different digital certificate for each of the 3 servers.
> 
> 
> 

This is not necessarily always the case. Consider the situation where all three servers are on the same domain, then you only need one certificate, if each of them is on its own subdomain you can have one single wildcard certificate installed on all of them.

On the contrary, if you have one server that hosts multiple domains you would have one single multi-domain SSL certificate.