I have an application that is hosted with AWS EC2 instance which is behind a load balancer with DNS say example.com. I would like to point multiple domains on a monthly basis to this load balancer (business onboardings). I also have a public certificate generated via AWS CMC. Block diagram for reference -https://i.stack.imgur.com/Dm7z7.jpg
With the addition of a new domain, I'm required to generate a new certificate every time (which is fair) and need to authenticate all the domains (old + newly added) via CNAME (which is really annoying).
Any suggestions to make this simple? I would like to have one Root CA and then add new certificates within them as chain, but is that feasible and is a good practice?
Better approaches are most welcome.
PS: I checked the thread - SSL certificate for CNAME redirected domain , however that looks to be a different use case.