If applicable you could even use wildcard certificates to avoid having your subdomains domains showing in CT logs.