If one has a phishing website that uses the original certificate that was obtained by accessing that website, can an attack fool users to believe they are accessing legitimate websites?
Yes. As long as they get the private key too.
To spoof a valid certificate (and get a green SSL-Padlock) only two ways exists, I know:
- Hack the website, get the private key and certificate and use it (hopefully the page has good security, so this doesn't happen)
- Find a buggy SSL certification authority and get a certificate, either by finding a bug or through social engineering doesn't matter, in the end you have a valid (signed by CA) certificate. This is NOT the same, but still valid
If not, how will it get caught?
As techraf already said, if the cert ist not trusted, e.g. because it is self signed or the CA was thrown out of your keychain, you an error like this:
Don't you need the same domain name for #1 to work? Won't LetsEncrypt do the same as #2 but without trying to be sneaky or illegal?
You need to somehow lead the victim to your own server, yes. This can be down by owning the DNS. Ebay was stolen a few years ago.
But you are right. Using the certificate does only make sense, if the original domain is used. Phising uses normally different domains, which you can officially and legally just get a certificate