@dashie Personally my workaround consist in making "buckets" of certs for differents things, like one for "public" subdomains and one for "private" subdomains