You are using the wrong tool for the Job!
Subdomains are not private. They can't be made private either. The reason why they can't be is because of DNS, or Domain Name System. Without going into too much detail, DNS is a database of all domains and subdomains, and values associated to them. A very simple example:
User: "DNS Resolver, which IP does ...
The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used.
This function checks that wildcard-CN/SAN like * or *.com are treated as invalid since they are too broad. *.example.com is instead acceptable. Thus check is done by counting ...
RFC6125 section 7.2 strongly discourages the use of wildcards inside an IDNA part of the domain name:
o There is no specification that defines how the wildcard character
may be embedded within the A-labels or U-labels [IDNA-DEFS] of an
internationalized domain name [IDNA-PROTO]; as a result,
implementations are strongly discouraged ...
There might be a Web Application Firewall with different profiles for different domains. So they might share the same ip address but every domain serves a different purpose and so different ports are allowed.
A WAF is able to "unterstandt" the http packets, that way it is able to determine the domain you try to connect to.
For the certificate it does not matter if it is a CNAME or a direct (A or AAAA) DNS record, all what matters is the domain as shown in the URL. The certificate must include this domain as subject or subject alternative name, it is irrelevant if this behind the scenes points via CNAME to some other domain.
From your description I assume that abc.example is ...
I actually know Patrik personally and will definitely ping him concerning your request.
I have published numerous technical write-ups on subdomain takeovers that include identifying vulnerable hosts using common commands and libraries that may be of interest to you. The best starting point is probably "A guide to subdomain takeovers".
Setup and workflow