That's correct, domain or sub-domain. And you'd need to get an SSL cert for it. Letsencrypt offers free SSL certs