This is another variant on "How does TLS work?".
With Diffie Hellman, the shared secret that results from the exchange (g raised to the power of a raised to the power of b mod p) is fed into the PRF (together with other values) and is used to generate AES keys (and other values). The keys from the certificate do not participate in this process. Asymmetric authentication is achieved by doing a new online digital signature on the values of the DH key exchange using the private key for the certificate, which protects from MiTM attacks.
With the obsolete RSA key exchange (which does not provide PFS and does not exist in TLS1.3), the client just generated a random value, RSA-encrypted it to the public key from the certificate and sent that. The server RSA-decrypted the value using the private key for the certificate, thus establishing a shared secret value and at the same time proving possession of the private key from the certificate. This allows retroactive decryption of network intercepts after the private key for the certificate leaks (even if the certificate is already expired). The shared secret value is fed into the PRF, yada-yada.