I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They will allow multiple certificates to be generated for a given domain; however, all certificates are subject to the root + one subdomain policy.
Are there any security problems with configuring multiple certificates for the host (one for the root +
www, and each subdomain will have its own root +
subdomain certificate)? I'm especially curious if this would be a problem with HSTS. Wikipedia states that the browser simply a) forces an HTTPS connection, and b) doesn't allow the HTTPS connection to be bypassed, so it would seem to me that this wouldn't be a problem for HSTS.
I know that a setup like this could lead someone to become suspicious of the website, but I use the certificates purely for data encryption--I would use a wildcard self-signed certificate if I didn't host things for others to use.
(I'm holding out until Let's Encrypt releases in September, so I'm not looking to buy a wildcard SSL certificate at the moment.)