Wildcard certs match subdomains with underscores, as pointed out by a sibling comment. Example: https://_.4a.si./