That's a great solution. Avoiding wildcard certs seems like a poor way to deal with the issue...