Wordpress did this by issuing Let's Encrypt certs on demand for every domain people CNAME their way.