In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant an attacker just take someones public certificate and identify himself as someone else?
A digital signature makes use of two keys a private key that can be used for producing signatures and a public key that can be used for verification of signatures. The certificate contains information that ties the identity of the signer to the public (verification) key but does not allow anyone to deduce the private (signing) key.
Anyone can present a certificate claiming to be the true signer, but only the true signer should be able to produce signatures that verify correctly.
If someone is able to steal the private (signing) key, they could indeed forge messages. For this reason the private keys should be stored privately and securely rather than broadcast in the way that the public certificates are.