The auto-provisioner was checking for individual cert files (e.g., git.civilsociety.dev.pem) without checking if a wildcard cert already covers the domain (*.civilsociety.dev.pem). This caused redundant individual certs to be provisioned for domains already covered by a wildcard. Now uses hasCertForDomain() which checks both individual AND wildcard cert coverage before deciding a cert is missing.