Ancient Observer,
As you describe it, that can only work by hijacking either the DNS entries in the network settings of the OS (to point all DNS queries to a false DNS server), or by writing to the hosts file.
It can direct the correct URL to a spoof website by resolving the URL to a new IP address by either of the mechanisms above. Once on the spoof site it can direct an incorrect SSL URL to a site for which it does have a genuine certificate.
What it will not be able to do is spoof the SSL certificate of the correct website.
So vigilance is required at all times!
SD