I've been reading about how certificates are used to verify the owner of a public key in asymmetric encryption. Right now everything seems really theoretical to me and I'd like to know how this works in practice. For example, do sites you log into such as Facebook (or this one) use asymmetric encryption?
What I don't understand is this: the certificate claims e.g. Facebook is who they say they are, and once verified the public key can be extracted from it. Isn't this more of the roll of the DNS server? A user types in
facebook.com and the DNS server is responsible for knowing
facebook.com resolves to e.g.
Some connections don't use DNS server you may say. For example a mail client may be setup to connect to a particular IP address. No problem. Then you should already know the IP address is the correct one: if it's not that's like saying you sent a package to the wrong address but are upset that the wrong person received it.
Last question, are the public keys usually not provided by the owner them self and actually the certificate authority (since according to here the public key is extracted from the certificate)? For example when I connect to Facebook is its public key given to me by DigiCert Inc, not actually Facebook?