When you don't attack traffic using MITM, TLS works like this:
Client <===========> Server
When you attack traffic using MITM, you get a third party to intercept and proxy communication
Client <=====> Proxy <======> Server
Security is negotiated separetly between
client <==> proxy and
proxy <==> server. A proxy will keep two connections open: one with the client and one with the server. This is typically used by AV vendors, malware, and enterprise filtering products. If a client trusts proxy's certificate then a browser most likely will not highlight the fact that you are speaking to a proxy instead of a real server. You will see a green bar in a browser to say communication is encrypted. If you click on the certificate you will see the
proxy certificate, instead of the real
server sertificate. Obviously this doesn't work if certificate pinning is involved.
If the client doesn't trust
proxy certificate (which is usually the case unless you specifically install
proxy cert in your Trusted Certificate storage) then you will see a certificate error.
There are a few posts online that talk about Burp, for example this one:
Burp CA certificate - Since Burp breaks SSL connections between your
browser and servers, your browser will by default show a warning
message if you visit an HTTPS site via Burp Proxy. This is because the
browser does not recognize Burp's SSL certificate, and infers that
your traffic may be being intercepted by a third-party attacker. To
use Burp effectively with SSL connections, you really need to install
Burp's Certificate Authority master certificate in your browser, so
that it trusts the certificates generated by Burp.