Three page rules on a free plan. With page rules you can control what happens when a visitor hit’s a specific domain / URL.
Every domain get’s it’s free SSL
Initially cloudflare issues a cert for your 2nd Level (domain.com) and a wildcard (*.domain.com) which covers the 3rd level like www.domain.com or home.domain.com and all other subdomains on this level.
How ever: if you have a sub domain like josh.home.domain.com the 4th level (josh) is not covered and you need to buy a cert from cloudflare for this sub zone. This will again cover josh.home.domain.com and a wildcard for the 5th level. and so on and so on…