A wildcard is a bad idea here since one compromised host would have a certificate that works on all other hosts. A better solution would be a sub CA that's res

A wildcard is a bad idea here since one compromised host would have a certificate that works on all other hosts. A better solution would be a sub CA that's restricted to issuing certificates for that domain only, but name constraints is an extension that some (obsolete) clients might not handle correctly.