I'm definitely understanding something wrong with the TLS process, and am hoping one of you fine folks will point out the flaw in my thinking.
So from what I've read on TLS, the client (and therefore any man in the middle (MITM)) knows or receives a web server's certificate, which amongst other things contains the public key to be used for encrypting the symmetric key used during TLS communication. (This next part is most likely my misunderstanding) My understanding is that the certificate separately contains the public key and the signature/host name verifying the authenticity of said public key. If that's the case, what's stopping a MITM from keeping the entire certificate including the signature and just replacing the public key portion with their own public key? At that point their key looks like it's signed by a trusted authority right?
Obviously I'm wrong, but can someone explain how I'm wrong in detail?