You can use SAN certificates to avoid wildcards while still validating for a number of domains.

They don't even need to be subdomains.

There's a limit to how many SAN's you can fit in one cert. There is apparently no defined upper bound, but dependent on the client's implementation. 25 - 100 names seems to be the common limit supported by most registrars.

In the parent poster's case, it sounds like a good use case for a wildcard cert. They may have thousands of affiliates, and may not know all of the affiliates ahead of time, so with a SAN cert, would need to reissue the certificate each time a new affiliate signs up.

https://community.letsencrypt.org/t/subjectaltname-certifica...

Oh, I completely agree—I maintain a SAN and it's a royal pain in the ass.

But there are options, and a SAN has lower risk if your key is leaked (only the enumerated domains will validate).