I have a domain name with dynamic DNS (DDNS) for my home server on which I expose multiple services (web server, wikis, issue trackers, etc.) online. Some services are hosted by the same software (e.g. web server for website and wiki run on different ports served by the same apache2
instance, others by separate software (e.g. issue tracker)). I only own the domain name without subdomains and distinguish the service by non-standard ports (e.g. 1234 to 1243). So far I used self-signed certificates in order to learn administration and get a minimum of security. That all works fine.
Now, I got a SSL certificate from letsencrypt.org and want to use it for as many service as possible.
Is it better practice to use as few certificates as possible/keep the chain as short as possible or is it considered better to have a separate certificate for each service/port? The former follows the KISS paradigma, but an issue with the certificate would affect all services (I don't know any, but there might be some), the latter would increase the maintainance at creation, setup and renewal.
There might be issues which arise after general availabilty of IPv6 which I'm not very firm with.