That will work as long as your tls certificate is also a wildcard of the parent domain, otherwise your subdomains can be found via it’s their certificate records. You probably know this, but caught me out initially, so figured I’ll mention it.