I'd assume it uses a single wildcard certificate.
Yes, thats exactly how it works for the multiple subdomains.