Here's how it works in a nutshell:
1) The client connects to the server. The server advertises the SSL/TLS protocols that it supports, and sends its SSL certificate to the client. The certificate includes an RSA public key, and the certificate is (presumably) signed by a recognized CA
that the client trusts.
2) The client verifies the certificate's CA signature, and (presumably) trusts that the certificate is valid. The client and the server agree to use ECDHE.
3) The client and the server generate a set of ephemeral ECDHE keys that are used to facilitate the secure session. The keys sent by the server to the client are signed by the server using the server's private key (which corresponds to the public key that was previously sent as part of the certificate in step 1 above). The client validates that the signature is valid using the server's public key received previously (which was previously determined to be trusted). Thus, the client can trust that the ephemeral keys that it received from the server were indeed sent from the server, and not from a man-in-the-middle attacker.
4) The client and the server proceed with secure session using the set of ephemeral keys. These keys are discarded by both the client and the server at the end of the session (and not reused) to facilitate perfect forward secrecy.