I do have a specific record for fw.net.domain.com and one for *.net.domain.com. they both point to same ip. I have issued a let's encrypt cert on fw.net and it worked fine.