Question: I have three questions regarding SSL that I don't fully understand.

1. If I get it correctly, a server `A` submits a request to a certain CA. Then, it receives (after validation etc.) a digital certificate composed of a public key + identity + an encription of this information using the CA's private key.

Later on, a client `B` wants to open an SSL communication with `A`, so `A` sends `B` its digital certificate.

My question is can't `B` just take this certificate, thus stealing the identity `A` - which will allow them to authenticate as `A` to `C`, for example. I understand that `C` will decrypt the certificate with the CA's public key, It will then encrypt its symetric key which will only be decryptable by the real `A`.

However, I do not see where authentication comes to play if `B` can actually steal `A`'s identity. Unless I am missing something.
2. Second question: Why use hashing on the certificate if a part of it is already encrypted by the CA? Doesn't this mean that no one can mess around with a digital certificate (in high probability) anyway?
3. If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.

Thank you very much.

Answer: 
> 
> My question is can't "B" just take this certificate, thus stealing the identity of "A" - which will allow them to authenticate as "A" to "C"
> 
> 
> 

There's also a private part of the certificate that does not get transmitted (the private key). **Without the private key, B cannot authenticate as A.** Similarly, I know your StackOverflow username, but that doens't let me log in as you.

> 
> Why use hashing on the certificate if a part of it is already encrypted by the CA? 
> 
> 
> 

By doing it this way, anyone can verify that it was the CA who produced the hash, and not someone else. This proves that the certificate was **produced by the CA, and thus, the "validation etc." was performed.**

> 
> If I am stackoverflow and I have 3 servers doing the same thing - allowing clients to access, read, identify etc. - do I have to have a different digital certificate for each of the 3 servers.
> 
> 
> 

It depends on the particular case, but you will likely have identical certificates on each.
First question: You are correct about what you get back from the CA, but you are missing part of what you need before you submit your request to the CA. You need (1) a certificate request, and (2) the corresponding *private* key. You do not send the private key as part of the request; you keep it secret on your server. Your signed certificate includes a copy of the corresponding *public* key. Before any client will believe that B "owns" the certificate, B has to prove it by using the secret key to sign a challenge sent by the client. B cannot do that without A's private key.

Second question: Typical public-key cryptography operates on fixed-size data (e.g., 2048 bits) and is somewhat computationally expensive. So in order to digitally sign an arbitrary-size document, the document is hashed down to a fixed-size block which is then encrypted with the private key.

Third question: You can use a single certificate on multiple servers; you just need the corresponding private key on all servers. (And of course the DNS name used to reach the server must match the CN in the certificate, or the client will likely balk. But having one DNS name refer to multiple servers is a common and simple means of load-balancing.)