Depends. In general, no. If the attacker launches a man-in-the-middle attack after HTTPS communication has already started, he can do nothing.
If he launches the attack beforehand, he can do various things. For convenience, let's assume that the server in question is GMail.
- Pretend to be mail.google.com: This is a pretty transparent attack. The attacker cannot obtain a trusted signature for his SSL cert, and thus cannot pretend to be Google without throwing an error similar to this one. If the client clicks through this; well, that's the client's fault.
- Catch you when you try HTTP: Some people enter
http://www.gmail.com, which means that their browser will first try HTTP. Most HTTPS-only sites issue a
301 Moved Permanently redirect, but an attacker can stop this from happening and pretend to be HTTP-GMail (and pretend to be you in communications with the real HTTPS GMail -- individuals don't have/need SSL certs so this impersonation is easily done once your password is with the attacker). Note that the browser icon will no longer have a green padlock in such a case. However, not all mobile browsers visually distinguish between HTTP and HTTPS. Generally it is better to use bookmarks and save history on the client side, and use HSTS on the server side to protect against this.
There used to be many other HTTPS implementation vulnerabilities (they're pretty much all fixed now). There probably still are a few. But most rely on the user not noticing (or blindly clicking through) a warning.