This is another note to self, I must have done this 20 or 30 times over the years but I can never remember exactly how.
The easiest way I've found to add subject alternate names to certificate requests is to add two lines at the end of /etc/ssl/openssl …