Here’s a Caddyfile snippet:

*.example.com {
    encode gzip

    tls {
        dns route53 {
            max_retries 10
        }
    }

    import log_dir

    import handles_dir - # `-` arg removes the customdomain header (in other words doesn't add it)

    handle /metrics/* {
        basicauth {
            admin {$PROMETHEUS_PASS_HASH}
        }

        reverse_proxy prom:9090
    }
}

I want sub2.sub1.example.com not to even generate a cert. How do I do that? Only 1 level subdomains should work.