TL;TR: having a certificate signed by a trusted CA is not enough if certificate checking is done right.
Only if all of the following points are true about the certificate sent by sslstrip then transparent man in the middle attacks are possible:
- The certificate must be signed by a trusted CA: this is easily possible.
- The certificates subject must match the name in the URL: you usually do not get a certificate with a matching subject for a domain you don't control from a publicly trusted CA.
- The attacked site does not employ certificate or public key pinning, i.e. builtin pinning like done for some important domains by the browsers or explicit pinning using the HPKP header.
Note that these points rely on the client doing a proper job with certificate validation. But older versions of PHP, Python, Ruby... don't do it and developers often switch off validation because it is annoying during testing or because they rather use self-signed certificates (which is fine if you have an explicit pinning in your application).