Question: I have three questions regarding SSL that I don't fully understand.

1. If I get it correctly, a server `A` submits a request to a certain CA. Then, it receives (after validation etc.) a digital certificate composed of a public key + identity + an encription of this information using the CA's private key.

Later on, a client `B` wants to open an SSL communication with `A`, so `A` sends `B` its digital certificate.

My question is can't `B` just take this certificate, thus stealing the identity `A` - which will allow them to authenticate as `A` to `C`, for example. I understand that `C` will decrypt the certificate with the CA's public key, It will then encrypt its symetric key which will only be decryptable by the real `A`.

However, I do not see where authentication comes to play if `B` can actually steal `A`'s identity. Unless I am missing something.
2. Second question: Why use hashing on the certificate if a part of it is already encrypted by the CA? Doesn't this mean that no one can mess around with a digital certificate (in high probability) anyway?
3. If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.

Thank you very much.

Answer: 
> 
> My question is can't "B" just take this certificate, thus stealing the identity of "A" - which will allow them to authenticate as "A" to "C"
> 
> 
> 

There's also a private part of the certificate that does not get transmitted (the private key). **Without the private key, B cannot authenticate as A.** Similarly, I know your StackOverflow username, but that doens't let me log in as you.

> 
> Why use hashing on the certificate if a part of it is already encrypted by the CA? 
> 
> 
> 

By doing it this way, anyone can verify that it was the CA who produced the hash, and not someone else. This proves that the certificate was **produced by the CA, and thus, the "validation etc." was performed.**

> 
> If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.
> 
> 
> 

It depends on the particular case, but you will likely have identical certificates on each.
I also have some answers.

Q1) If B steals A's certificate and try to impersonate as A to C.

* C will validate the IP address of B and find out that it does not belong to C. It will then abort the SSL connection. Of course, even if C sends an encrypted message, then only the Real A will be able to decrypt it.

Q2) A certificate is usually represented in plain-text using the common format X.509. All entries are readable by anyone. The hashing process is used to digitally sign a document. Digital signing a certificate makes the end user validate that the certificate has not been altered by anyone after it was created. Hashing and encrypting the content using the issuer's private key is done to create a digital signature.