Wildcard certificates
When a wildcard helps, when it hides risk, and why DNS-01 is mandatory.
Operational tradeoff
One private key covers many hostnames. That is convenient and increases blast radius if the key leaks. Prefer platform-generated keys stored encrypted, or bring your own CSR from an HSM you control.