Doing this completely undetected is actually harder than you think. Modern browsers check Certificate Transparency lists, and if the certificate is not present in at least two lists then they are simply rejected.

In addition to this you have Certification Authority Authorization (CAA) which uses DNS to tell what CAs are allowed to sign certificates for a certain domain.

There are services you can subscribe to that will tell you when a certificate signed by a (or anyone but) CA for a domain you want to monitor.