Two ways to cover more than one name. A wildcard covers everything at one level; a SAN certificate lists exact names. They cost the same to run with Let's Encrypt, and the difference is operational.

SAN - a list of names

sudo certbot --nginx -d example.com -d www.example.com -d shop.example.com
  • Works with HTTP validation - no DNS API needed.
  • A new subdomain means reissuing, which is one command.
  • The certificate publishes the list of names, so every subdomain you have is public.

Wildcard - everything at one level

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d '*.example.com'
  • Covers any subdomain, including ones that do not exist yet.
  • Requires DNS validation - so renewal needs API access to your DNS provider, or a person present every sixty days.
  • Covers ONE level only: *.example.com does not cover a.b.example.com.
  • Does not cover the bare domain - list example.com as well, as above.

The security difference that decides it

A wildcard key is valid for every subdomain. Put it on five servers and any one of them being compromised gives an attacker a certificate for all of them, including the payment subdomain. A SAN certificate per server keeps that blast radius small.

What to choose

  • A handful of subdomains on one server - SAN. Simpler validation and simpler renewal.
  • Many subdomains, or generated ones per customer - wildcard, with automated DNS validation.
  • Subdomains on different servers - a separate certificate for each, whatever the count.
sudo certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cf.ini \
  -d example.com -d '*.example.com'
Automate it either way. A manual DNS challenge every sixty days is a renewal that will eventually be missed - see wildcard subdomains.