A digital certificate is supposed to be used between client and server in order to establish the initial trust. The client has to choose to trust the server.
I can understand in a secure model, the client will always know who the server is.
https://internal.sitea returns a certificate that the client would recognize since it has had dozens of previous exchanges.
But what is to prevent someone in the middle doing a simple
hello with the server, and reusing the digital certificate, to establish its own cipher suite with the client, and acting fully as a man in the middle?
I apologize if I am misunderstanding anything about the overall certificate exchange process. Please feel free to let me know.