While there are many TLS configurations, I will describe the most common setup.
The public key is fixed on the server side - it is the servers public key. Upon connecting to the server and receiving the public key, the client then validates the key by checking that it has not expired, that it matches the domain name of the server who sent it, and most importantly, that it has been signed by a recognized certificate issuer.
The list of certificate issuers is managed by the browser, and with each software update the list can have entries added and removed. Ultimately, you are trusting your browser vendor to keep the list of well reputed certificate issuers up-to-date.
Once the authenticity of the server certificate has been established, the symmetric encryption will begin under a randomly chosen session key which is discarded after the connection is terminated. This session key is negotiated by the client and the server using the servers ability to decrypt data that you encrypt using the public key embedded in it's certificate.
Using an asymmetric encryption algorithm to establish symmetric session keys in this way is known as hybrid encryption. Asymmetric encryption is used sparingly in practice because it is much slower than symmetric encryption.