Using a CA they control is only essential if they don't want to be caught. However, I would assume most webrowsers in China are using CINIC certs. At that po

Using a CA they control is only essential if they don't want to be caught. However, I would assume most webrowsers in China are using CINIC certs. At that point it would be trivial. Just return a different DNS entry, and have your CA verify it. Sure, pinning might alert some people that something is going on, but what are they going to do about it? I could have done it 10 years ago with WCCP and a bluecoat. But yes, I was wrong about them openly breaking SSL for decades. Doesn't mean it would be difficult.