A company hosts several public-facing services on separate subdomains: shop.example.com, mail.example.com, and portal.example.com. The security team wants to secure all current and any future subdomains with TLS while minimizing the number of certificates they must purchase and manage. Which certificate solution best meets this requirement?