Traefik with tls wildcard subdomains and tenant

Question

I have this configurations :

image: ${DOCKER_IMAGE}
      labels:
          # Explicitly instruct Traefik to expose this service
          traefik.enable: true
          # 80 is the port that the nitrogen_app container image is listening to
          traefik.http.services.app-erp.loadbalancer.server.port: 80

          ## Unsecure configuration
          #traefik.http.routers.app-erp.entrypoints: web
          #traefik.http.routers.traefik-dashboard-http-router.rule: PathPrefix(`/`)

          ## Secure configuration
          traefik.http.routers.app-erp.entrypoints: web-secure
          ## Rule based on the Host of the request
          traefik.http.routers.app-erp.rule: HostRegexp(`{subdomain:[a-zA-Z0-9]+}.my.it`) && !Host(`www.my.it`) 
          # Enable SSL authentication for this domain
          traefik.http.routers.app-erp.tls: true
          traefik.http.routers.app-erp.tls.domains[0].main: my.it
          traefik.http.routers.app-erp.tls.domains[0].sans: "*.my.it"
          # Set letsencrypt as resolver
          traefik.http.routers.app-erp.tls.certresolver: letsencrypt

I'm unable to get certificate for each subdomain, i cannot use Host(subdomain.my.it) that works, because it's a tenant application and name is dynamic, how can i solve this?