This question already has an answer here:
Sorry if this has been asked before, but I couldn't find an answer anywhere. Maybe I overlooked something, but I just can't wrap my head around how certificate validation works.
This post details how SSL / TLS works, but when it comes to certificate validation, things aren't so clear to me.
As I understand it, the point of certificates is to guarantee that I, as client, correctly identify the certificate (e.g. Google, I will use Google as an example from now on) and ensure a public key exchange.
To simplify things, I will assume there is no certificate chain, that is, the certificate Google sends is a trusted root certificate. Now, Google sends me this certificate (a byte stream, let's call it B) that is signed using the CA's private key. Using the CA's public key, I am able to verify that indeed the certificate was signed using the CA's private key, thus trust is ensured.
The question I have is this: Is this byte stream (B) that Google sends to me always the same? Does Google send the same thing when creating a secure connection? If so, what stops me from taking this and using it to incorrectly identify myself as Google? If it is unique to each request, then it seems that Google needs to always contact the CA to encrypt it using their private key.
What am I getting wrong?