Given your answer to my comment above, I agree with Ladadadada. Creating a CA is easy, but getting other people to trust it is hard: either you need to distribute your CA root certificate to each of them (which you can't do, as you've confirmed they're random end-users), or you need to get the browser makers to include it in their standard trusted bundle (and good luck with that).
Since you don't want to just tell each subdomain owner to do it themselves, your only remaining option that I can see is to get each subdomain owner to generate a CSR, and then you act as a central clearing house, submitting each of these CSRs to a certification authority.
Many of the big SSL certificate houses have a policy whereby you can go through a one-time lengthy process to establish yourself as authoritative for (eg)
example.com, but once this is done, applications you make for anything inside
example.com apparently go through very quickly indeed.
I don't use Verisign (or Symantec, as they now are) and wouldn't endorse them here even if I did; I link to them simply so you can see one example of such an arrangement: Symantec's portal to getting yourself established as authoritative for a domain ("key features" include "Instant issuance of certificates on pre-approved domains"). If you decide to take this route you should shop around and choose an SSL certificate issuer that's right for you.