If they're internal domains you can run your own CA. No need to use wildcard certs or pay anything at all.