Wildcard vs SAN Certificates: A Decision Guide for Engineers Who've Been Burned by Both

Most teams pick a wildcard certificate the same way they pick coffee: whatever the team running the infrastructure happened to grab first. Then someone leaks the key, and you discover that one .pem file was authoritative for 200 subdomains, including...