Two ways to cover more than one name. A wildcard covers everything at one level; a SAN certificate lists exact names. They cost the same to run with Let's Encrypt, and the difference is operational.
SAN - a list of names
sudo certbot --nginx -d example.com -d www.example.com -d shop.example.com- Works with HTTP validation - no DNS API needed.
- A new subdomain means reissuing, which is one command.
- The certificate publishes the list of names, so every subdomain you have is public.
Wildcard - everything at one level
sudo certbot certonly --manual --preferred-challenges dns \\n -d example.com -d '*.example.com'- Covers any subdomain, including ones that do not exist yet.
- Requires DNS validation - so renewal needs API access to your DNS provider, or a person present every sixty days.
- Covers ONE level only: *.example.com does not cover a.b.example.com.
- Does not cover the bare domain - list example.com as well, as above.
The security difference that decides it
A wildcard key is valid for every subdomain. Put it on five servers and any one of them being compromised gives an attacker a certificate for all of them, including the payment subdomain. A SAN certificate per server keeps that blast radius small.
What to choose
- A handful of subdomains on one server - SAN. Simpler validation and simpler renewal.
- Many subdomains, or generated ones per customer - wildcard, with automated DNS validation.
- Subdomains on different servers - a separate certificate for each, whatever the count.
sudo certbot certonly --dns-cloudflare \\n --dns-cloudflare-credentials /etc/letsencrypt/cf.ini \\n -d example.com -d '*.example.com'Automate it either way. A manual DNS challenge every sixty days is a renewal that will eventually be missed - see wildcard subdomains.