Is this about using *.foo.com wildcard and/or re-using certs across services and/or multi SANs? i.e. you have a host www.foo.com but it's also the corporate ma

Is this about using *.foo.com wildcard and/or re-using certs across services and/or multi SANs? i.e. you have a host www.foo.com but it's also the corporate mail server, and happens to host webmail etc etc and you re-use that same cert/key pair? I've always created one pair per service. You can always setup a new DNS name and get a free lets encrypt cert (new name or a SAN - they don't , or didn't, do wildcards).