There are several ways to resolve this issue: 1. Get a separate certificate for each subdomain. Let's Encrypt makes this feasible since the certs are free and

There are several ways to resolve this issue: 1. Get a separate certificate for each subdomain. Let's Encrypt makes this feasible since the certs are free and require a minimum of human overhead to obtain. 2. Get a single certificate that covers each subdomain by using Subject Alternative Names, which are currently supported by Let's Encrypt. 3. Get a wildcard certificate for "*.xyz.com". Let's Encrypt does not support this and I do not think it plans to, at least not in the initial release. The main question is - is the set of subdomains known before-hand, or is it highly dynamic? If it is fairly stable, then options 1 or 2 will work well for you; otherwise, you probably want option 3. Choosing between option 1 and 2 usually depends on the details of your infrastructure and your threat model. For example, are all these subdomains served from the same server or different servers? If it's the same server, you might be more inclined to use 1 cert for all of them (option 2) since it will be easier to manage. Do all the domains have the same threat model? For example, what if you run blog.xyz.com on one server and billing.xyz.com on a separate, hardened server. In that case, you would want option 1 because if you used the same cert on both servers, obtaining the private key from the less-secured blog.xyz.com server could be used to attack traffic for billing.xyz.com.