I have a free Cloudflare account where I manage my domain (ie: mydomain.com) and I use the free SSL certificate (mode Full SSL) in order to get SSL on a subdomain (blog.mydomain.com hosted with Github Pages).
The domain root is not secured by Cloudflare SSL but it has its own separate SSL certificate.
As you probably know the Cloudflare SSL certificate is shared between several domains (often adult sites) and it's a wildcard type. (so it contains *.mydomain.com, *.malicious.com, mydomain.com, malicious.com)
The web application is hosted on mydomain.com and app.mydomain.com is also secured with its own SSL certificate. Can these domains somehow be in danger because they share a certificate with malicious.com and malicious.com probably has access to the same SSL certificate shared with mydomain.com?