Imagine the following scenario:
We have Bob that wants to send a message to Alice. Both have a public/private key. Bob uses his private key to sign the digest (hash of the message) with it's private key, and sends along it the plain text message. Alice receives the message, it uses Bobs public key to verify the signature, to verify if the message is from Bob, and it hashes the plain text message and compares the hashes/digests, and if they are the same, it means that the message was not altered with and the message is from Bob.
But the authenticity part is not entirely solid, that is where digital certificates come into place. I'm am failing to see how a digital certificate can proof the message comes from the person Alice expects it to come from. The digital certificate contains the name of Bob, and a public key. But what if a hacker intercepts the message, and has it's own digital certificate with the name "Bob" and his own public key in the certificate?
The question is: How can Alice verify the message comes from the real Bob and not the fake one? And how is the validation exactly done? In real life, I can use a passport to identify myself, that is because my face is unique... but with the information in the certificate, how is that even enough for authenticity?