Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them.
The communication goes as follows:
Alice sends a hello to Bob, and includes some parameters (say, an ephemeral Diffie-Hellman public key) A. Eve intercepts the message and replaces A with E.
Bob replies with parameters B, and also sends his certificate which contains his public key and his domain. Eve intercepts this. At this point Eve and Bob derive a shared secret EB from E, B, and their associated private data (say, associated ephemeral DH private keys), which Alice does not know.
Eve forwards the message from (2) to Alice, leaving the certificate the same (not being a CA, she can't create her own) but changing B to E. At this point Alice and Eve derive a shared secret EA from E, A, and associated private data, which Bob does not know.
Alice verifies the certificate. It wasn't tampered with, so no flags are raised.
Alice encrypts a message using Bob's public key (from the certificate) and sends to Bob. It contains the shared secret EA.
Eve intercepts this message (which admittedly she can't decrypt), and discards it. She instead sends Bob a new one, encrypted with his public key, containing the shared secret EB. Bob looks at this and it matches the shared secret he was expecting, and so considers the handshake to be a success.
From now on Bob and Eve have a conversation using the shared secret EB, and Eve and Alice have a conversation using the shared secret EA. Neither Bob or Alice are aware that Eve is eavesdropping.
Supposedly, this is meant to be prevented by the certificate, but I don't understand how.