[AcidBurn]

Other than Amazon Certificate Manager as moatra mentions (which I don't think let's you export the certificate), I don't think there is currently an option for free wildcard certificates.

As an alternative you could incorporate provisioning of a Let's Encrypt certificate for the new subdomain into your deployment process since the process is designed to be automated.

[iancarroll]

Current rate limiting wouldn't really make it possible, unfortunately.

[x0]

Not if you have more than five subdomains, you have to wait for a week, like me.

[detaro]

... if you need a different certificate for each subdomain. You are limited to 5 certificates per domain per week, each of which can be valid for many subdomains. Bad if you want to be able to add them dynamically every time a new name comes up, but if it is a static set...