Can't China just issue its own certificates to make the browser see a secure connection to the target server when it talks to a Chinese firewall server instead.

Can't China just issue its own certificates to make the browser see a secure connection to the target server when it talks to a Chinese firewall server instead. I mean they have access to valid root certificates, right?