This question involved a serious security vulnerability at WoSign.
Here's the finder's blog: http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fwww.schrauger.com%2Fthe-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com&oq=cache%3Ahttps%3A%2F%2Fwww.schrauger.com%2Fthe-story-of-how-wosign-gave-me-an-ssl-certificate-for-github-com
Quoting a part:
GitHub is used to store programming projects. It is a code repository. But it also gives each GitHub user their own subdomain to have a main webpage for their code. The users can do whatever they want with the page.
Thus, I naturally had full control of the subdomain schrauger.github.com and (schrauger.github.io). After verifying I owned these domains to WoSign by uploading their text file, I was allowed to generate a certificate for these two subdomains. Perfectly fine.
He said that he got valid TLS certificate signed by trusted CA to the domain schrauger.github.com as he was able to upload file and verified ownership via HTTP verification methods.
So my question is, if I can get valid certificate for some xxxxx.github.com, can't I MITM those sites and read *.github.com's cookies?
As parent domain cookies are sent to subdomains too, what prevents me from MITMing .github.com website authentication cookies?