Could you confirm whether my understanding of the SHA-1 collision issue is correct?
If for certificate $A$, the message digest equals to $X$ and a Root CA signs it with its private key everyone can verify its authenticity by decrypting the signature with the public key that is pre-loaded in to the browser in form of a X.509 certificate, correct?
So given the hash value of $X$ over the certificate and while not knowing the private key that signed the hash, I know that the final result (signature) = $Y$.
I compute another certificate (with the Issuer filed set to the Root CA that signed the real certificate) so that it’s hash value will as well = $X$. So with two different certificates (data input) we were able to get the same hash (collision occurred).
I still don't know the signers (Root CA that signed the original certificate) private key, but I know that the hash value of $X$ signed with his private certificate = $Y$.
I take my fake certificate and try to impersonate the legit website. I "steal" e.g. copy the signature (bytes) from the original certificate and send them along with the fake cert to the user/browser when the connection is set up.
Now, the browser will run few checks. It will, try to decrypt the signature with the public key that is wrapped in the X.509 certificate that is pre-loaded in to the browser.
Because we assume (we hope) that our hashing algorithm is collision resistant, the public key decrypts the signature and the browser is able to calculate the same hash value, hence proving the authenticity of the certificate and that it was not changed during transit.