I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending messages to Bob and a man in the middle (Trudy) is trying to intercept Alice's messages. They describe what Trudy can do to try and trick Alice into believing she is communicating with Bob. The conclusion they draw is she cannot.
However there is one situation not covered:
Suppose that Bob has a certificate containing his public key and a hash signed by a Certification Authority. He makes this certificate available to anyone as is common practice
Trudy gets Bob's certificate and modifies it replacing Bobs public key with her own.
Trudy intercepts Alice's request for Bob's page. Trudy sends back a fake page to Alice containing the modified certificate. When Alice get's this fake page she sees that when she runs the SHA-1 algorithm on the certificate, she will get a hash that agrees with the one she gets when she applies the CA’s public key to the signature block (the signature block has not changed from Bob's original). So Alice encrypts her message to Bob using Trudy's public key (Trudy put this in the certificate when she modified it). Trudy can now decrypt and read the message she intercepts from Alice.
Will the above scenario work?