As far as I understand, it is possible to have multiple TLS certificates per domain name. Let's say I own example.org website and have a certificate for it. If an attacker gets a certificate for example.org, couldn't he/she perform a MITM attack on my website?
This situation seems analogous to MITM attack in Kazakhstan, the main difference is that the attacker does not have a root certificate. However, root is not required here because only a single site is attacked.
What am I missing here?
If an attacker gets a certificate for example.org, couldn't he/she perform a MITM attack on my website?
The big word here is "if". This is why ownership validation exists. In order for an attacker to get a certificate by a trusted CA, the CA needs to validate that the attacker actually owns the domain.
Sure, I could request a certificate for example.org, but I cannot in any way prove that I own the domain. So as a result, no trusted CA would sign my request. In fact, if they would and it would become public, it is very possible that that CA would no longer be trusted - which, of course, would be a worst-case scenario for them.
The situation in Kazakhstan is very different. There, the government and all ISPs intercepted all internet traffic, violating all TLS guarantees. As a result, all browsers there will display "This site is insecure!" and urge users not to visit them. A security-conscious user would reject the connection and then...not have internet connectivity anymore until the MitM attack ends. Other users would continue, knowing their connection is being intercepted.
The reason this is different is that the Kazakh government doesn't have a valid certificate for any site, which is why this warning appears in the first place.
As schroeder pointed out in the comments, merely owning a certificate isn't enough to perform a Man-in-the-Middle attack. In order to perform that, you need some way of redirecting your target to your system.
This could be done locally via ARP spoofing, or remotely via DNS hijacking.
If an attacker gets a certificate for example.org, couldn't he/she perform a MITM attack on my website?Yes. But, this would require the attacker to dupe a CA into issuing a certificate for example.org, to someone who does not control example.org. We rely on CA's ensure this does not happen.