Just to add to the other comments, you probably want to use a wildcard cert so you don't need to individually certify each subdomain (or expose them at all).