If you have per-user sub-domains, just get a wildcard cert, pay for it, and cover all your users all at once. Why do you need want to go through LE for that purpose?