@Artem does this answer your question in any way? • The CNAME or one of the Subject Alternate Names (SANs) on the certificate must match the hostname that osquery clients use to connect to the server/proxy. Here is the section of the docs talking about the subject matter https://fleetdm.com/docs/deploying/introduction#tls-certificate

@Artem just got a confirmation: A wildcard cert should work.

<http://foo.bar.com|foo.bar.com>

should “match” a SAN of

*.<http://bar.com|bar.com>

. I hope this helps