I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control But they did control it. The domain's name

I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control But they did control it. The domain's name servers were pointed to route53 ips, which were controlled by the attackers. If they setup a dns server, they can point those entries to any server they want. They certainly could have gotten a dv ssl certificate for any of the domains affected.