The basis of certificate security is that a third party (the issuer) certifies that the certificate has been delivered to someone having appropriate rights on the domain.
If as a client I trust the issuer, I can trust any certificate it has signed.
The possible frauds are:
someone comes with fake documents showing that he owns the domain. Could be done, but issuer must be very cautious about that because that part is their real job, and if they can easily be cheated nobody will trust them any more
someone hacks an issuer and gets a valid private key allowing certificate signing. The security rules in serious certificate issuers tends to make this extremely hard, and it is likely that the stolen certificate will soon be revoked
In fact, it is generally assumed that the cost of obtaining a fake certificate will not be worth it. There are plenty other simpler ways to steal information on the web, on in real life.
Never forget what can be done with a $5 wrench…
Of course things may be different when you think of government agencies. I have no real proof whether it is true or not, but I think that is state security was really concerned, they could ask a valid certificate for a third party domain to do legal interceptions.