You can serve HTTPS without your own domain, but not by credentialing a subdomain.
Certificates correspond to owned domains, not subdomains. This is because you can prove that you own a domain, but there’s no mechanism to validate you “own” a subdomain.
Some web hosts will allow you to serve your site via HTTPS from inside a domain they own.
This provides some of the most important benefits of TLS/SSL, but not all of the benefits of having your own cert. Users can be assured their data is encrypted on route to your site. But if they check the cert, they will see the web host’s information, not yours.
And since the owner of the site will be different than the owner of the domain, you won’t be able to get the ”green bar” that is available only through Extended Validation Certification.