What do you use for SSL on wildcard multisite?

Running a WordPress multisite with wildcard subdomains on Leaseweb. Current setup:

1. Main domain: example.com
2. Subdomains: site1.example.com through siteN.example.com
3. Currently using Let's Encrypt with manual SAN expansion

Hitting the 100 limit on older certbot versions (before 2.6.0). Running certbot 2.7.4 now but my hook script still requires manual intervention when users create new sites.

Question: Is anyone auto-expanding SANs on multisite without hitting rate limits? I process roughly 15-20 new subdomains weekly.

My current certbot hook is functional but brittle. Seeking a more robust pattern.

Oh you want (well "want" is strong) (maybe "need") automation for this (which I also struggled with (back at my old job (which was actually a wordpress shop (don't ask)))) and the thing about Let's Encrypt https://letsencrypt.org (this was 2021 so grain of salt (or entire salt mine)) is that the rate limits (which everyone fears (unnecessarily (usually))) are actually not the problem you think they are (ironic given your exact question (sorry))

Man, I use this hook for my multisite on GreenCloudVPS, going to share here man

#!/bin/bash
# auto hook for certbot
DOMAINS=$(wp site list --field=domain --path=/var/www/wp)
certbot certonly --manual-auth-hook /usr/lib/letsencrypt/hook.sh \
-d "example.com" \
$(echo $DOMAINS | sed 's/ / -d /g')

Running for 8 months, no rate limit issue hahaha. This going to expand automatic, man. Just cron it every 12 hour man.

Rate limits are 50 certificates per registered domain per week. Your 15-20 weekly subdomains fit easily. Stop worrying.

Locked. Take it to DMs if you want my hook.