You need one cert (or at least only a handful of certs)—SAN entries do not need to be subdomains of the CN. Greatly reduces headache of ssl-terminating for e.g. client domains.