Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and

Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs. 1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR.