I'll assume you know DNS resolution, which turns a URL like hexbear.net into an IP address. You try to go to hexbear dot net from your browser. But someone has set up a man-in-the-middle-attack. So when your browser tries to resolve the URL into an IP address, instead of the actual IP address you get a different one which could be hosting malware. TLS certificates help the browser (and other clients apart from browsers) make sure that the IP address is the authentic one.

Certificate Authorities have a process to confirm the real IP address of a domain name. Once they confirm it, they issue certificates which you can then serve to whoever is whoever is trying to visit your URL. If I am a malicious man-in-the-middle attacker, you can assume that I cannot get a certificate authority to give me certificates. This is because I don't own and control the domain name. You do.

Certificate authorities use cryptographic fuckery to sign certificates. They use their private keys to sign these certificates. Clients (like browsers) making web requests have their ways of knowing which legitimate certificate authorities exist and what their public keys are. So if a website serves you a certificate, your client will be able to verify that it is authentic.

But if the private signing key of a legitimate certificate authority is known, this security model falls apart. Because anyone can create a legitimate certificate. So if I am a man-in-the-middle attacker, I can serve forged certificates and your browser will never be able to tell because they look authentic to it.