I think you’re confusing the basic Diffie-Hellman, which is a key exchange protocol, with the ‘authenticated version’ which uses a certificate authority (CA).
Nice explanation of how the basic Diffie-Hellman is vulnerable to man-in-the-middle from RSA Labs.
“The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle
attack. In this attack, an opponent Carol intercepts Alice’s public
value and sends her own public value to Bob. When Bob transmits his
public value, Carol substitutes it with her own and sends it to Alice.
Carol and Alice thus agree on one shared key and Carol and Bob agree
on another shared key. After this exchange, Carol simply decrypts any
messages sent out by Alice or Bob, and then reads and possibly
modifies them before re-encrypting with the appropriate key and
transmitting them to the other party. This vulnerability is present
because Diffie-Hellman key exchange does not authenticate the
participants. Possible solutions include the use of digital signatures
and other protocol variants.”
and it follows with the authenticated version, also known as the Station-to-Station protocol:
“Roughly speaking, the basic idea is as follows. Prior to execution of
the protocol, the two parties Alice and Bob each obtain a
public/private key pair and a certificate for the public key. During
the protocol, Alice computes a signature on certain messages, covering
the public value ga mod p. Bob proceeds in a similar way. Even though
Carol is still able to intercept messages between Alice and Bob, she
cannot forge signatures without Alice’s private key and Bob’s private
key. Hence, the enhanced protocol defeats the man-in-the-middle
attack.”
So the basic version is susceptible to a man-in-the-middle attack, the authenticated version that uses public key certificates is not.