TIL: Wildcard SSL certificate does not support nested subdomains

A wildcard SSL certificate for *.example.net will match sub.example.net but not sub.sub.example.net. You need to generate a separate certificate for *.sub.example.net.

Source

Free Cloudflare account does not support creating a wildcard SSL certificate for sub.sub.example.net, you need $10/m subscription for Advanced Certificate Manager from Cloudflare.