I can't imagine that they ever would give you that, because it would break everything about PKI for the real example.com domain. If you got valid private keys f

I can't imagine that they ever would give you that, because it would break everything about PKI for the real example.com domain. If you got valid private keys for it from an authoritative CA, you could conduct a man-in-the-middle attack (amongst other things) and there'd be little to no way for anyone to notice. Now locally on your own network, you can set up a certificate authority and your own DNS service for the domain, and then do whatever you want within the confines of your local network. But you won't be able to reach the real example.com at the same time, since you'll be configured to route example.com through your internal imitation of the external network for at least that domain. I used to do this for "hacme.corp" (which is not currently a valid domain on the Internet) for teaching penetration test courses.