I know more or less about how TLS works in principle.
But how can I be sure, that the certificate behind a server's web site (e.g. tele-banking from my bank) has been issued to my bank and not to someone else.
Let's say there is a faked tele-banking portal, to which I get connected accidentally. If they got a certificate issued by a CA, everything works and my data are transmitted to the fake site.
So I would have to check the certificate every time I use the portal. But how? My bank says:
The Bank XXX login pages are encrypted and therefore begin with "https://". Always check the owner of the security certificate, which must be "XXX Bank XXX" with the Internet address is highlighted in green color prior logon to your OnlineBanking.
Now, virtually everybody can get a signed certificate with owner="UniCredit Bank Austria" from a CA. Does CA-1 know about other certificates issued by any other CA-2? I cannot imagine that this is the case. But how can I be sure, that the certificate I want to rely on is not a fake?