The problem with this is that you have to complete domain control validation at the apex of the domain, not just on each hostname. If you do per hostname, you

The problem with this is that you have to complete domain control validation at the apex of the domain, not just on each hostname. If you do per hostname, you can ask a CA to send a validation request to http://sub.domain.com/.well-known/pki-validation/.. http://sub.domain.com/.well-known/pki-validation/... and by nature of that hostname CNAME'ing to your domain (which they'll need to do anyway), you can complete it. If you do at the apex, you'll need to complete DCV out of band, e.g., by having an email sent or adding a separate DNS record above/beyond what's being used to point to you.