To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone can put a Microsoft's DN in his certificate's issuer DN and send it to the client along with a Microsoft's certificate that is being trusted by every computer. How does this certificate validate and verifies the server then ?
No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures.
So you either need to ...
- create a fake signature (which is cryptographically hard),
- get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of microsoft.com)
- or sign the certificate with a self-made root certificate (then you can sign anything - but no PC will trust you as long as your root certificate is not imported into their system).