What type of pki certificate can be used for dns subdomains that fall under a parent domain