Yes, they do. But if you use a wildcard cert for your review app, then you are not testing the same cert machinery as your production application. (Unless you want to use wildcard certs for your prod app too, which I'd rather not do.)