If they run
https://example.com/myapp/ then it's their responsibility to get a trusted certificate, as certificates are validated at domain level. They would then have to run a reverse proxy to your site. Then it doesn't matter what your certificate is, because the end user will never see it.
Otherwise, you can use Subject Alternate Names to assign a single certificate for multiple domains.
The good news is that because both of the domains are pointing to the same site, you don't need to worry about SNI extensions, which can break backwards compatibility for older browsers.