Sorry I wasn't clear, @jxself. coffeecode.ca is my domain; withknown.com is their domain. They offered TLS on thunk.withknown.com, because they have a wildcart cert for *.withknown.com. But they can't offer TLS on thunk.coffeecode.ca because... complex.