As I understand it, if Alice and Bob wants to communicate securely, they must first agree on the protocols that will be used. Then they must confirm that they are indeed communicating with each other. This is done via certificates signed by some trusted third party. The public key and hashing algorithm used by the third party are already stored on your computer. Alice then sends Bob her certificate and Bob sends Alice his certificate. They both verify the certificate's signature using the third party's public key. If it's valid, they start their key exchange and such. However, what is in those certificates that confirms their identity? I imagine it can't just be "Hi, this is totally Bob/Alice, trust me." I would imagine that Bob's certificate must contain Bob's public key, but wouldn't it be unsafe if Bob used the same public key everytime? Wouldn't it be better if he could use a different public key for every client?
Also, does a website (such as Amazon) have only one certificate that it sends to all clients, or is a new certificate signed by the third party for every client that connects to the website?
I would also appreciate some sources on the basics of the application of asymmetric cryptography if anyone has some simple sources (I'm still a dummy though).