the_mitsuhiko parent
The one complaint that I think is valid is that automating wildcard certificates at the moment is really tricky. And that really is because most of the DNS providers do not have proper APIs for it.`
Most? https://registry.terraform.io/search/providers?q=dns seems to be a pretty healthy list, and https://registry.terraform.io/providers/hashicorp/dns/latest will work for any one that honors https://datatracker.ietf.org/doc/html/rfc2136 (although "honoring standards" is probably the very problem you were citing)