I'm trying to understand the following:
Lets say Alice wants to encrypt a message with the public key of bob. There can be a man-in-the-middle attack who impersonates bob. So we uses digital certificates so we know the public key is who alice thinks the public key is from. But I don't really understand how this concept works..
Even if there is a digital certificate, you will still use the public key written in the certificate, how is the certificate bound to a specific identity (in this case to Bob)? Is is for example based on the ip-address?
I really want to understand this, If someone could help me out, I would really appreciate it!