https://docs.fusionpbx.com/en/latest/getting_started/lets_encrypt.html#using-letsencrypt-sh
You can use a wildcard SSL certificate to cover every subdomain. I.e. a.onkatel.us, b.onkatel.us, maruf.onkatel.us and so forth
For auto renewal you would need to install and use another program like...