Comment by hollow-moe

If applicable you could even use wildcard certificates to avoid having your subdomains domains showing in CT logs.