I thought about having a single proxy server pointed to by the A record, and have that server route requests to the sub-domains That way, any sub-domain will use the proxy server's wildcard cert