In NS7 there was one cert with alternative names for the other names.
To check the alternative names of a cert:
openssl s_client -connect domain.tld:443 | openssl x509 -noout -text | grep DNS
With NS8 the apps using letsencrypt just have their FQDN in the cert. Only the custom letsencrypt certificates use CN and alternative names like it was in NS7, see also Certificate overview in Core 3.6.0 - #4 by davidep
Let’s check if there are manual or failed certs:
root@home:~# api-cli run module/traefik1/get-facts
Warning: using user "cluster" credentials from the environment
{"custom_path_routes": 0, "custom_host_routes": 0, "custom_certificates": 0, "acme_manual_certificates": 4, "acme_auto_certificates": 8, "acme_failed_certificates": 0}