This question already has an answer here:
- How does SSL/TLS work? 3 answers
Here's how I understand what SSL certificates actually do, in 4-year-old-child terms. There need to be three parties involved. Two parties are just my client, and the server I'm communicating with, while the third is the certificate issuer. My client will ask the certificate issuer if the server I contacted is really the server it says it is, the certificate issuer will propose a challenge to the server, and respond to me if it went well.
Here's the thing though. When I searched for other people asking about man-in-the-middle attacks, answers said it would only be possible if the third party (the certificate holder issuer) got its private key stolen, which the man in the middle could use to fake its identity by completing the challenge, or something like that...
However, without stealing the private key, and without stealing anything -- if the man in the middle can impose as the server of the site I'm trying to reach (simply by redirecting its domain name to its own IP), then what's stopping it from doing the same with the certificate issuer's server? So for example, it could redirect Facebook's IP address to its own server to try to get me to enter my account credentials, and when my browser tries to ask Digicert (the certificate holder for facebook.com) whether I'm communicating with the authentic Facebook server, the man in the middle could also redirect Digicert's IP address to itself again, and wrongly confirm to me that Facebook really is Facebook.