Actually, the cert does apply, because 'github.com' is explicitly listed in the subjectAltName extension. (Names in that extension are considered valid alternatives to the common name in the subject; see RFC 5280 4.2.1.6.) It really is a wget bug, or more likely an OpenSSL bug.