TLS 1.3 RSA key exchange

Question

I have some confusion between the different public and private keys that are used in a TLS 1.3 connection. When a client makes a request to a server, I've always thought that a server's TLS x509 certificate was passed to the client and certificate was used to encrypt traffic between client and server. However, as I read more into it, it seems like the client and server generate individual public/private keys specific to the connection and that those keys are used for to bootstrap the encryption (to create a shared secret).

If my understanding of that is correct, how is the server's (CA issued) x509 certificate and key used, and when is the cert delivered to the client? Is it only used to establish the identity of the server and not used at all when encrypting the channel?

Also, a major feature of TLS 1.3 seems to be the removal of RSA for key exchange (and only support DHE and ECDHE). Does this mean that TLS certificates issued to a server can't be RSA-based, or does that "removal" only apply to what I understand as the aforementioned public/private keys that are generated on a per-session basis for the key exchange?

Answer 1

I've always thought that a server's TLS x509 certificate was passed to the client and certificate was used to encrypt traffic between client and server

This approach isn't widely in use anymore since it doesn't support Forward Secrecy. Modern TLS cipher suites (e.g., a subset of TLS 1.2 cipher suites and all TLS 1.3 cipher suites) use the certificate for authentication only. The client verifies the authenticity of the server's certificate, and a separate DHE/ECDHE key exchange is used to get the keys for symmetric encryption.

when is the cert delivered to the client? Is it only used to establish the identity of the server and not used at all when encrypting the channel?

Exactly. Also see The New Illustrated TLS Connection.

Does this mean that TLS certificates issued to a server can't be RSA-based, or does that "removal" only apply to what I understand as the aforementioned public/private keys that are generated on a per-session basis for the key exchange?

For authenticity, ECDSA or RSA can be used. So "TLS certificates issued to a server" can be still RSA-based.For key exchange, ECDHE or DHE can be used.