If the attacker doesn't have the private key that matches the Subject-Public-Key-Info, then he won't be able to impersonate your server given such a cert. (If h

If the attacker doesn't have the private key that matches the Subject-Public-Key-Info, then he won't be able to impersonate your server given such a cert. (If he has, then there's no need to produce a replacement cert; the official one is good enough).