I'm using RSA (4096) and AES GCM (256) to exchange messages between A and B. A random key for AES is generated, the plain message is encrypted with AES, and the random AES key is encrypted with Bs public key. The encrypted message and key are sent to person B. Lets assume they use an insecure server, they didnt share a secret offline etc. Is there any way for person B to make sure A sent the message and not a man in the middle?
In what's described, nothing makes B sure that A sent the message. And that can't be obtained without some secret on A's side.
A common solution is to have A sign the (e.g. encrypted) message, and B check the signature.
A PKI (perhaps, implemented using digital certificates) can help ensure B uses A's genuine public key, which is required for this proof or origin to work. It can also help ensure A uses B's genuine public key, which is required for confidentiality is the question's protocol.
The GCM operation is an authenticated encryption algorithm designed to provide both data authenticity (integrity) and confidentiality. So B can ensure that A is sender.