GitBook custom domain HTTPS certificate validation scope

GitBook supports publishing a space to a custom subdomain with managed TLS provisioning once DNS points to the target shown in the space's domain settings.

The documented setup uses a per-space CNAME for subdomains, with automatic certificate issuance and renewal after validation. Documentation describes the exact hostname configuration and notes differences for apex domains and plan-dependent features.

It is not clearly documented whether a configured custom domain receives wildcard certificate coverage for arbitrary deeper subdomains, or whether each hostname must be configured separately. Renewal timing and diagnostic detail are also limited in the dashboard.

Does GitBook issue a certificate only for the exact hostname configured in domain settings? Is wildcard coverage for *.example.com provided automatically when a subdomain is configured? What is the documented certificate scope for nested hostnames under a configured custom domain?