Does the Shappening mean HTTPS can be broken? For years we've been warned that SHA-1 is weaker than originally thought and should not be used.  This reached its peak with the Shappening and experts from Schneier on down have been warning that we should get off SHA-1, or something bad will happen.

What are the practical 'something bad's?  Once an attacker has the capability to create a SHA-1 collision, what then can they do?  I'm interested in confidentiality and integrity of HTTPS, but am open to broader answers.

Specifically would it be feasible to do a MITM attack by creating a fake certificate for an existing website?  It seems plausible: the attacker creates a fake certificate with the same name, but varies the other data in order to produce a SHA-1 hash that matches the SHA-1 hash of the original certificate.
SHA1 certificate is getting weaker because computing power grows to Moore's Law. According to Jesse Walker, who made a back of the envelope calculation of the cost of SHA1 collision attack: 


  the cost of the attack will be approximately:
  
  
  \$2.77M in 2012
  \$700K by 2015
  \$173K by 2018
  \$43K by 2021
  
  
  A collision attack is therefore well within the range of what an organized crime syndicate can practically budget by 2018, and a university research project by 2021.


To your question:


  What are the practical 'something bad's?


The practical "something bad" is that sometime this year, all major browser vendors (Google, Firefox, Microsoft) would distrust sha1 certificate. This means that your site/servers will be blocked with a big security warning, it might actually be more sensible to not use HTTPS at all than to use SHA1 certificate at that point. Some browsers now already no longer shows the secure lock icon on sites with SHA1 certificate.


  Once an attacker has the capability to create a SHA-1 collision, what then can they do?


Certificate signature is made by taking a hash of the public key and attached data (owner identity and Common Name/SAN) and then the CA signing that hash with the CA's private key.

If you generate two keypairs with the same SHA1 signature, you can convince a CA to sign one of the public key and that signature will also be valid for the other key. From there on, it's a simple matter to implant the CA's signature on the second certificate. That second certificate could be for a different domain that you don't actually control.