[munchbunny]

I believe LetsEncrypt will issue you a certificate for that subdomain if you can control the server responding at that subdomain.

EDIT:

Specifically: https://letsencrypt.org/docs/challenge-types/

It won't give you a wildcard certificate, but you don't need one for the type of attack we're talking about.

[sroussey]

Well, hopefully they use certificate pinning. And if not, they should do certificate transparency like chromes does.