Over the last couple of years, there were a few instances when some third party managed to create a SSL certificate for a domain that doesn't belong to them, for example google.com, or most recently github.com.
In my limited understanding, accessing a signed web site means my browser will compare the domain I'm accessing with the certificate it offers. So, if I somehow manage to get people to my phishing site called
g00gle.com using the
google.com certificate, my browser should complain that the certificate is not valid for this domain.
Obviously, I must be missing something here, this wouldn't be all over the news otherwise. What kind of mischief is possible, or likely, using a valid SSL certificate that points to someone else's domain?