Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - please comment, critique, and add more that you can think of:
Get a less-reputable CA to issue a basic HTTPS cert. Manipulate the target's DNS requests to direct traffic to a server you control, which will give the appearance of a "valid" HTTPS connection (in the absence of additional precautions e.g. Certificate Patrol) .
Snipe an active domain, get a reputable CA to issue an EV cert. The existence of the EV cert can be used to delay/prevent the "true" owner from regaining control, because the domain snipers now have better proof of ownership.
I think DNSSEC will protect against #1 in cases where the trust anchors are deployed via browsers (e.g. Firefox), and the browser installer itself is signed. The obvious issue is that not many domains are DNSSEC-enabled. (Counterpoint: Many important domains are DNSSEC-enabled).
Are there any other attack methods?