You can have example.com and *.example.com on the same certificate.

I didn't find docs specific to wildcard + non-wildcard, but LE certs can use multiple subject alternate names. So whatever tool you use, use SAN to request both *.example.com and example.com into one cert.

I imagine you have to setup your stuff to respond to the DNS + web based challenge/response.

.

You can have multiple names in the cert, including the apex.

Here is how I do it using acme.sh:

    acme.sh --issue --dns --force --yes-I-know-dns-manual-mode-enough-go-ahead-please -d "${domain}" -d "*.${domain}" > /dev/shm/.le."${domain}".txt