Not all that off-topic. For your example, you should get a certificate made out to ("Subject CN") example.com or * .example.com, then list both the wildcard and

Not all that off-topic. For your example, you should get a certificate made out to ("Subject CN") example.com or * .example.com, then list both the wildcard and the subdomainless entry as Subject Alternative Names. Bing is doing something similar (see https://news.ycombinator.com/item?id=5576271 https://news.ycombinator.com/item?id=5576271), but they appear to have forgotten to list the plain domain.