We got wildly distracted about a dot in a bucket name and browser certificates but I think all of that discussion is completely irrelevant. ANY CDN is going to allow HTTPS configuration so there is ZERO ISSUE with the “wildcard cert” problem and a dot or no dot in the bucket name WITH REGARDS TO END USER BROWSER CERT. Because again, ANY CDN is certainly going to allow this.
So OP can simply…
(1) pick an S3 and CDN compatible storage solution and configure endpoint and bucket name in Discourse settings.
(2) Configure CDN to fetch images from S3. Secure or insecure. I don’t think OP cares as long as CDN serves to user via HTTPS.
Someone please correct me if I am missing something here. I think the end user browser cert + dot in bucket name problem is ONLY an issue if you are going to serve the images FROM the bucket. Irrelevant to serving from CDN.