I'm trying to understand the following:
Let's say Alice wants to encrypt a message with Bob's public key. There can be a man-in-the-middle attack who impersonates Bob. So Alice uses digital certificates so she knows the public key is who Alice thinks the public key is from. But I don't really understand how this concept works.
Even if there is a digital certificate, you will still use the public key written in the certificate. How is the certificate bound to a specific identity (in this case to Bob)? Is this, for example, based on the IP address?