A MitM will create a certificate whose signature will be successfully validated against the certificate of the fake CA in your trust store.
forFor example, if someone managed to install fake (fraudulent) CA certificate (which is under attacker's controlto which they have the private key) into your trust store, issuedthey could use that CA cert's private key to issue a fakefraudulent certificate tofor security.stackexchange.com. If they then had an MitM position, they could intercept your request for security.SE, and routed you to fakesupply their fraudulent certificate. Your browser would accept it as valid for the StackExchange web site. Browser will be happy and tell that everything is just fine, while in reality everything you are visitingsend and receive goes through the attacker (who fully controls the traffic both ways and could even be serving you a totally fake web site, with fake). Everything would look fine from your end because the certificate which is trusted by your browsedbrowser, because you trust the attacker's fake CA which is the issuer of the site's (fraudulent) certificate.
