RSA usage in non-ephemeral Diffie-Hellman

Question

What is the purpose of RSA when used together with non-ephemeral Diffie-Hellman? Isn't static DH authenticated, as the static DH parameter of the server is included in the signed server certificate?

Answer 1

Technically, DH_RSA means that
1. A DH key is in the certificate
2. The client certificate is signed by the intermediate certificate using RSA

This was initially specified in TLS 1.0.

In TLS 1.2, this can differ, as the signature_algorithms extension can override RSA in DH_RSA, meaning the certificate could also be signed with DSS if DSS is specified in the signature_algorithms extension.

TLS 1.3 gets rid of all these complications by just removing DH altogether (luclily).

In other words: Your intuition that the certificate already validates the DH key share is correct, and the server does not send a KeyExchange message. Instead, the RSA in DH_RSA indicates the signatures used in the certificate chain due to legacy reasons.