You can encrypt any subdomain at which you can serve an answer to Let's Encrypt's ACME Challenge [1][2].
That being said, I know they have a blacklist of certain domains. I've seen it once with amazonaws.com [3], and it's possible they have similar entries for azure.com, heroku, etc. They don't publicly release their blacklist.
That being said, I know they have a blacklist of certain domains. I've seen it once with amazonaws.com [3], and it's possible they have similar entries for azure.com, heroku, etc. They don't publicly release their blacklist.
[1] https://letsencrypt.org/how-it-works/
[2] https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.txt
[3] As in "my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com"