It's my experience that wildcard security certificates (like the one amazon has for .s3.amazonaws.com) do not work past one level of subdomain. That is to say a certificate issued to .example.com will work on www.example.com and sales.example.com, but not www.sales.example.com or shipping.us.example.com.