SslWebBinding 1.3.0 (and DnnWebsiteManagement 1.4.2 which relies upon it) support mkcert now. If it's installed, it will be used to generate a single certificate for all host headers. It's also assumed that mkcert -install has been run to trust the CA.
Ideally, we'd create a single trusted root the first time it's run and then generate certificates from that later on.
In the meantime, can we generate a single certificate for all bindings?