Replying to @benwerd
Since my server is Express anyway I use code cobbled together from a few npm modules that automatically provisions a cert for domains and subdomains it knows about. It's likely totally overkill but since I'd done that for science.ai (where it makes sense) I had it around 🙃