Or perhaps do it the other way around? Make a Let&#x27;s Encrypt subdomain-blacklisting TXT record with which the parent domain could indicate that they don&#x27;t want subdomain owners to be able to create their own SSL certificates. (Useful in the case of hosted web services, for example, where the parent already owns a wildcard certificate so there&#x27;s no reason for the subdomain to create one)