I'm in the process of buying an SSL cert, and I'm confused by this part: Many CAs say they'll add
www. to your domain, so that e.g. if you buy a single-domain cert
app.example.com, they'll also add
www.app.example.com as a matching domain name in your cert.
A related example is that if you buy a wildcard cert, say
*.example.com, some CAs also say that they'll give you a cert that covers
example.com (I know that if your CN only has
*.example.com, it will not match
In both cases, they only seem to ask me to specify one CN –
Which makes me wonder: How do they add the
www. part (
app.example.com) or the bare domain part (
*.example.com) when they issue me the cert?
In addition, when we create a self-signed cert, can we also use the same technique? If so, is there any example using OpenSSL to do it? I already know how to create a self-signed cert and have your users trust your "in-house root CA cert", so I'm curious about what it takes to add additional CNs (or is it the
subjectAltName field?) to your CSR or the eventually-issued cert.