If you go with a cert try to get a star cert that way you make it a little bit harder for hackers to find your subdomains.

I use it but only on containers where I can configure it to not do major updates, sadly most images don't have the needed tags for this 😢

If you have a script like this any chance you could open source it?