Web sites hand out the public certificate, that's the way TLS authentication (identity) works (excepting aNULL ciphers). If, for example, you were able to use Heartbleed to steal a site's key, the required certificate would already have been given out by the server during the handshake (for every correctly set up TLS connection).
No creation of a certificate is required. Were it required or desired, then a CSR can be generated from the key material. Then that CSR could be signed by a commercial CA, your last line of defence is the weakest verification policy of the most lenient CA. Not very comforting ;-)
Clients which implement certificate pinning should not, in theory, fall for such a bogus certificate.
You could also sign it with your own private CA, the resulting certificate would be valid in a technical sense, just not accepted by clients (which verify CA chains, and won't recognise your private one).