PKI Validation - Usefulness of the public key with the identity certificate I have some understanding of how PKI works, similar to this:
- https://knowledge.digicert.com/solution/SO16297.html
- https://security.stackexchange.com/questions/59566/ssl-certificate-chain-verification
- https://security.stackexchange.com/questions/56389/ssl-certificate-framework-101-how-does-the-browser-actually-verify-the-validity

What isn't obvious to me is how the public key at the end of the chain, or the identity certificate is used. Previously RSA may have been used for encryption, or as the key exchange for a symmetric cipher key, however ECDHE appears to be the modern primitive for key exchange.

My guess is the certificate is also signed by itself, along with the intermediates and roots in the chain. This would make sense to me since in my mind anyone would be able to use the cert in various ways, however if signed with the private key of the identity it's an extra check. Other wise I would see the identity private key as being pretty useless.

Most explanations are very simple with how a chain is evaluated and I'd like some detail.

So my question - is an identity certificate also signed by itself? Does my logic above stand up?
I may have found an answer here: https://devcentral.f5.com/questions/difference-between-root-cert-intermediate-cert-and-ssl-cert


  One more thing one the public key of your server certificate. There is
  the same mathematical relationship as described above between the
  public key and private key of your server certificate. 
  
  It will be used during the SSL handshake. The client encrypts some key
  material servers public key (retrieved by the client out of the server
  certificate) and sends it to the server. It can be decrypted by the
  server using the private key. If the server does not have the matching
  private key it cannot decode the key material and the handshake
  brakes.


But the above may be referring to using RSA for symmetric key transference, which like I posted earlier is generally done by ECDHE these days.

I imagine you'd just be able to take the certificate and use it to spoof a site if you successfully hijack DNS without any validation of the identity certificates public key. Surely it's validated in some way.