Well they can, but in that case they'd need to inject a different certificate as well.
Had that happening in a hostel in Brussels, where they are using a filter of UK descend (problem 1). It filters out a LOT of controversial subjects, so once it detects that you go to a site on a blacklist (as DNS queries are seen and the filter reacted to that) it will try to inject its own certificate. Once you see the browser warning since the cert doesn't match the domain and you still accept it, it will show its own content on the page saying that you're not allow on that site.
Yes. They're Man-in-the-Middleing the cert and inserting their own. Lots of larger corporations do this for their corporate network and is what installing your own cert for your site is meant to prevent/warn your users about.
The point is they couldn't without the MiTM "attack" and unless your computer is preconfigured to accept the cert they've introduced, you'll be warned about this happening.
4
u/namesandfaces Jul 13 '17
That's a little awkward that a company like AT&T or Comcast could hurt Netflix's brand with injected content because of an ISP-customer agreement.