A cert for .test.domain seems reasonable, for example, especially if the test infrastructure is dynamic, and you e.g. have CI/CD for a Cartesian product of:

every branch

* several test data sets

* several feature flag / configuration sets

* ...