[couchand]

And the beautiful thing about domains is that they're hierarchical, so you can arbitrarily split your trust boundaries.

[blagie]

A cert for .test.domain seems reasonable, for example, especially if the test infrastructure is dynamic, and you e.g. have CI/CD for a Cartesian product of:

every branch

* several test data sets

* several feature flag / configuration sets

* ...