On the upside, they basic offer certificates that are free for non-commercial usage and help out quickly. If you have a more complicated domain setup (e.g.
whatwg.org requires both
*.html5.org), you have to get validated for USD 60. That validation then allows you to issue as many non-commercial certificates as you want for domains you own for about a year. If you pay, the certificates last for two years, otherwise one.
Now the downside:
sub.example.com it will likely pick the latter, even though that might not at all be the most common name.