Thank you for your reply. That is great. I hope that as the number of domains/subdomains we have increases, so does the ability for us to pay for someone to do the DNS validation.
In the meantime: Can I add new domains on separately, with an SSL certificate to renew and a script to automate this?
For example: if a new domain/subdomain needs to be added 2 weeks after I've created SSL certs for the bulk of our domains, can that be added and renew automated on its own, without having to include the current domains (with up to date certs)?
So SSL certs for new domains are added and automated gradually, then I don't have to do anything further with those certs?