I'm wondering why there are two Algorithm Identifiers in a X509 certificate. One is in the "to be signed" part and the other one is at the end right before the actual signature.
Are they used for the same purpose? Do they have to be the same? Can implementations choose which of these two fields they evaluate?