We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of their potential security risks at least in the production environment.
Not taking in consideration the costs associated to the purchase of certificates (one per web application) they claim that the solution is not feasible because all SSL certificates are managed on the load balancer.
I have no experience in managing load balancer; I suppose that it's like an Apache configuration with more than one virtual host, each virtual host with its certificate (i.e. https://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm). A recent news from Akamai says that SNI is widely adopted (https://blogs.akamai.com/2017/03/reaching-toward-universal-tls-sni.html).
What are the real difficulties in managing many certificates on a load balancer?
Is there some best practices from authoritative source?