To avoid subdomain discovery, I usually acquire certificate domain level and add a wildcard SAN.