Which key is used to encrypt certificate and certificate verify message in TLS1.3?
I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
Due to the design of TLS 1.3 and different to earlier TLS versions the normal (EC)DHE key exchange is already finished once the server sends the certificate. They key
server_handshake_traffic_secret used to encrypt the certificate and other handshake messages is based on the same key material as the keys which are used for the application data later. For the exact details on which separate keys exist and how they are derived from the common key material see RFC 8446 section 7.1 Key Schedule.