Certbot
Generate a new certificate via webroot, but do not install it automatically
sudo certbot certonly --webroot --webroot-path "{{path/to/webroot}}" -d "{{subdomain.example.com}}"
Generate a manual DNS validated wildcard certificate
sudo certbot certonly --manual --preferred-challenges dns -d "{{example.com}},{{*.example.com}}"