To reduce the number of issued certificates for LE, a solution is to
request one certificate for several domains. This can be done if all
domains are part of the same virual host definition (with
serverAliases) or by using useACMEHost instead of enableACME
attribute. In the later case, the user still had to add the
appropriate domains to the extraDomains attribute of the certificate.
We do that for them.

This has been tested with the following configuration:

    security.acme.production = false;
    services.nginx = {
     enable = true;
     recommendedTlsSettings   = true;

     virtualHosts."exo.89.145.160.62.nip.io" = {
       forceSSL = true;
       enableACME = true;
       serverAliases = [ "exo3.89.145.160.62.nip.io" ];
     };
     virtualHosts."exo2.89.145.160.62.nip.io" = {
       forceSSL = true;
       useACMEHost = "exo.89.145.160.62.nip.io";
       serverAliases = [ "exo4.89.145.160.62.nip.io" ];
     };
     virtualHosts."exo5.89.145.160.62.nip.io" = {
       forceSSL = true;
       enableACME = true;
     };
     virtualHosts."exo6.89.145.160.62.nip.io" = {
       forceSSL = true;
       enableACME = true;
       serverAliases = [ "exo7.89.145.160.62.nip.io" ];
     };
    };

And I get certificates with the following subject alt names:

 - DNS:exo.89.145.160.62.nip.io, DNS:exo2.89.145.160.62.nip.io,
   DNS:exo3.89.145.160.62.nip.io, DNS:exo4.89.145.160.62.nip.io
 - DNS:exo5.89.145.160.62.nip.io
 - DNS:exo6.89.145.160.62.nip.io, DNS:exo7.89.145.160.62.nip.io