Anyone can publish to name.yourdomain.com with the Surge CLI. Surge runs the serving, certificates and accounts; you see the usage and set the rules.
Uses your Surge account. Don't have one? Run npx surge login first.
Approve the sign-in in the window that opened. Check that it shows this code:
No window? Open the approval page.
A domain you've published to with Surge, open to anyone or only to the members of the org that owns it. Point its nameservers at Surge so every name under it gets a certificate: