Let's encrypt is fine and a step into the correct direction. You would have the exact same problem with every classical CA, you just have to put the correct URL

Let's encrypt is fine and a step into the correct direction. You would have the exact same problem with every classical CA, you just have to put the correct URLs into the subject alternative name. A convention browsers adopted for different reasons, which now leads to a less intuitive situation. The "identity" market with their dubious ideas would currently ensure that we end up with a worse solution than we have now. Wildcard certs for every subdomain can be a bad idea if we look at the numerous cloud services that provide subdomains to their clients.