You can simply add the alternate names to the certificate when signing. For example, if you use OpenSSL and you use the
server_ca section when signing (e.g.
openssl ca -config my.conf -name server_ca -in server.req -out server.crt) , make sure you have a section similar to the following in the config file you use when signing:
x509_extensions = server_cert
subjectAltName = @server_alt_names
DNS.1 = subdomain.domain.com
DNS.2 = subdomain
To verify your certificate, pipe it to
openssl x509 -noout -text. You should see a line like this in the output:
X509v3 Subject Alternative Name:
I saw the comment about SNI but if you just sign the certificate SNI will not matter at all (as long as both names are supposed to point to the same content). This method works for sure for Firefox and IE, not at all for Chrome and wget. In fact, the CN in the certificate does not even matter if you have the names listed as alternate names.