Let's theoretically assume that a browser skips the check that a certificate it receives belongs to the stated CA (that's an exercise).
How could I exploit this in order to impersonate to a server? In other words, if some client requests site A, and I have MitM capabilities, can I redirect the user to my evil site?
I thought about forging a certificate for my evil site, and then sign the forged certificate with another forged one of a CA that I also forge, which signs the initial certificate for me (in other words: I sign for myself).
In the forged cert, I'd state that I am site A, attach my public key and in then (hash and) sign the cert with my own made up sign key $K_s$ (let's say RSA but it doesnt actually matter).
Now I'd put $K_v$ which is the public validation key as the public key of the CA cert I forge, and attach this CA cert to the server cert.
Now, when the user requests site A, I return him my evil site with the two certs I fogred.
The browser then skips the CA check and just validates the signature with the previous CA cert public key (extracting the hash and then comparing the hashes), and it's OK. I also assume here that the Trust Anchor check is also skipped, thanks to the base assumption.
Is my idea correct?