Copying my comment from above in the hope it gets more listen as it's a path for option #1, which if practical for your ops team, seems best.

I was disappointed to hear about the limit to wildcard certs. digicert.com/welcome/wildcard-plus.htm purports to sell certs that will work for foo.bar.example.com and bar.example.com - Their copy says: Even more, DigiCert WildCard ssl certificates are unique in allowing you to secure ANY subdomain of your domain, including *multiple levels of subdomains with one certificate*. For example, your WildCard for *.digicert.com com could include server1.sub.mail.digicert.com as a subject alternate name.  

I am not affiliated with digicert in anyway; just surprised by the issue, googled, and well...