I'll try my best to answer your questions here:
Q: What are the certificates associated with each of them?
I do see SitecoreIdentityServer and all other website assigned by default with
Sitecore Commerce services SSL certificate(localhost) after installation.
The certificate associated to the Commerce Engine IIS websites is an SSL Server Certificate. This is required to encrypt all traffic to/from the Commerce Engine, Sitecore BizFx (Business Tools), and Sitecore Identity Server over https. For development purposes, a self-signed certificate with CN localhost is created. Once you change the hostnames for production use, you can get your own SSL certificate and update the binding.
Q: Why Identity server certificate exist?
Moreover I do see the thumbprint of Identity server assigned on the SitecoreIdentityServer appsettings.json but the certificates is not assigned to it or any websites. We also create Sitecore commerce engine connect certificate but that is also not assigned to any of the bindings of any of the websites.
- Identity Server certificate
This is used by Sitecore Identity Server to sign and validate identity and JWT access tokens. Business Tools users are authenticated against the Identity Server and this is where it comes into play.
Configuration: The thumbprint for this certificate is configured in your Identity Server wwwroot\appsettings.json file.
- Sitecore Commerce Engine Connect certificate
This is a client certificate required to authenticate clients to Commerce Engine using certificate authentication. Commerce Engine Connect uses this to get access to the Commerce Engine. Calls made to Commerce Engine, eg. by the SXA Storefront go through Commerce Engine Connect. An X-ARR-ClientCert header is added to requests with the certificate information such as thumbprint to authenticate the call.
Configuration: Once you install the certificate to your LocalMachine Personal Certificate store, you also need to add it to IIS Server Certificates.
Commerce Engine is configured with the thumbprint of this certificate in wwwroot/config.json. And the same thumbprint is configured in Commerce.Engine.Connect.config for Commerce Engine Connect (the client). You don't need to do this manually, as the SIF installation should take care of this.
Update: You can read further on my blog post here: https://sitecoredude.com/the-dudes-guide-to-certificates-in-sitecore-experience-commerce-9/
