No clear definition on proxy settings

hello, No clear definition on how proxy domains and external-prefix-origin works.
Do one have to create and generate ssl cert for the subdomain in external-prefix-origin with its corresponding alias like e.g(cdn, cdn1, cdn2, cdn3 etc)?
