In reply to Sarunas.

Not true, you can get Let's Encrypt for every subdomain. They don't do wildcard certificates, but deploying multiple individual certificates is just as easy as deploying one.