Subsequent to writing the material below I have learned that some use the term “PKI” to include cases where the private key holder is also the CA. Stuff below is largely about conflicts between the two.
These are the opportunities that an attacker has to defeat the authentication provided by web site certificates.
He must both:
The attacker must avoid detection for the duration of his attack which may be months. To do this he is probably careful not to disrupt traffic that he intercepts from non targets. This may be done by blindly passing such traffic thru to the legitimate site.
See a note on public keys and some further rambling.