The only advantage I can see for a subdomain is that you can delegate some permissions to this sub-domain, and protect the management of the parent domain. E.g. in a large organisation you might want to give access via API or GUI to managing the DNS to users. If you give users access to example.com.ge.inc then then they have access to the entire domain. But by making a sub-domain, you can limit their access to that sub-domain only. This is kind of handy if you want to say, use Letsencrypt and give the certbot API access only to the iseinfr.example.com.ge.inc subdomain. Sure, the domain in this case is quite a mouthful, but the concept is very useful.
I have been experimenting with Letsencrypt's certbot, using ISE 3.3 latest APIs and it's now possible to enrol and re-new certificates every 60 days. The certbot framework is an amazingly well written application - and the documentation is brilliant.
I have to admit I am not a fan of short-lived Admin certificates because of the upheaval it causes when you have to renew them. I wish there wasn't this update-tax involved - updating a certificate should not be such a disruptive process - web servers have been known to restart in seconds - not 10-15 minutes.
If possible I advocate using organisational PKI signed certs for ISE Admin, with the longest possible lifespan allowed in the organisation - 3 or 5 years or more. There is little to be gained by this obsession to renew certificates for services that are not external facing. It's almost as asinine as the mandate to change passwords every 90 days.
For public facing services, just use Letsencrypt (if you can integrate it) and get a new cert every 60 days.
I'd love to see ISE having native certbot/ACME support for the Portal at least.
