If you use the Full (Strict) mode, you may run into Invalid SSL certificate 526 on www or other subdomains. Even though their official documentation claims that adding a A record with * should work, it didn’t for me.

The solution is to add Redirect Rules for them.