Why aren't we using SSH for everything? (2015)
shazow.net
shazow.net
You would not have separate certs for each subdomain but is that a problem? arguably more convenient.
There is also the open source headscale, which I haven't used but seems to be well respected.
this is the answer. but fantastic read of an article
But, at least over wi-fi, I've found it to be too slow to be useful.