For wildcard certificates, you’ll need to be able to control the DNS settings of the (sub-)sub domain. It isn’t necessary to control the “base” domain, as long as you can add a TXT record to a specific subdomain of the (sub)domain you want a certificate for. For example: you’ll need to be able to add a TXT record called _acme-challenge.floogy.selfhost.bz to the public DNS.