Certificates for many user-controlled subdomains

The PSL then is probably going to be your best bet.