It can be anything! An apex, subdomain, or even a URL.

Results fordomain.invalid

Logged At	Not Before	Not After	Common Name	Matching Identities	Issuer Name
2016-10-01T19:54:56.885	2014-02-19T18:59:54	2014-05-19T23:30:00	dr.safestore.it	Safestore-Bedford-PIX-Primary.default.domain.invalid	C=US, O="Entrust, Inc.", OU=www.entrust.net/rpa is incorporated by reference, OU="(c) 2009 Entrust, Inc.", CN=Entrust Certification Authority - L1C
2016-09-20T17:55:25.124	2010-01-11T20:54:12	2011-01-12T20:54:07	asavpn1.und.edu	ciscoasa.default.domain.invalid	OU=Organization Validation CA, O=GlobalSign, CN=GlobalSign Organization Validation CA
2013-03-26T09:34:57.186	2010-04-08T04:42:19	2013-05-14T05:00:45	sslvpn.ritsumei.ac.jp	ASA5520-01.default.domain.invalid	OU=Organization Validation CA, O=GlobalSign, CN=GlobalSign Organization Validation CA