Let me explain via a practical example.
There are a set of Certificate Authorities (CAs) that browsers implicitly trust. You can see the list of trusted CAs in your browser. For eg. the CAs trusted by Chrome browser can be found at "Wrench Menu > Preferences > Under the Hood > HTTPS/SSL (Manage Certificates) > Authorities tab".
So, the certificate that mail.google.com presents to your browser is 'signed' by Thawte SGC CA. This CA is implicitly trusted by the browser. These CAs will issue certificates only after thorough (and manual) verification.
You and I cannot trick Thawte or Verisign to sign us a fake certificate for google. Although such cases do happen but are rare and mostly require some insider help.
Now, on your own machine, you can go ahead and create certificates stating them to be of google.com. But these certs are 'self-signed' and will not be trusted by browser because the CA (you) are not in its trusted certificates list. In this case, browser will show you the certificate warning.
So, now to answer your question, there are a couple ways in which spoofed certificates are created (or made to work):
Just as I mentioned above, a person can trick a CA (which is trusted by browser) to issue you a certificate for a site which doesn't belong to you. For this reason people often manually remove trusted CAs from their list. God know what procedures does that CA in that never-heard-of country follows. I've seen paranoid people removing CAs from browsers trusted list.
The CA gets hacked (or is made to issue fake certs). In such a case you can issue certs at your will. Not to mention, such CAs immediately go out of business once this is found.
You can also have a fake "self-signed" certificate of google.com and still manage to bypass the browser security check if you explicitly add your own CA to browser's trusted list. Companies can do it. I've seen (and worked at) companies where they openly do it for "Compliance reasons". Since your desktop machines are in their control, they install their own CA to your browser's trusted store and present a fake gmail cert to the browser - which browser trusts and they happily intercep ALL your conversations/emails.
In all the cases - what do you get by faking a certificate: You can MITM (Man in the middle) the server and the users computer and decrypt the SSL session.
I've left many finer nuances of certificate creation in my description above to present a broad picture. You can read about Cert Patrol and perspectives to see how you can prevent falling a victim of a fake certificate even if its CA is in browsers trusted list.
You can also read about certificate pinning which can help prevent such certificate hijacks.