Yes, the _correct_ way to do it is with a CA certificate. But since CA certificates do not have a CommonName or SAN, you have to have clients that support SNI s

Yes, the _correct_ way to do it is with a CA certificate. But since CA certificates do not have a CommonName or SAN, you have to have clients that support SNI so you know what host the client is requesting so you can quickly generate and sign a one-off certificate. The browser restrictions were in place before SNI was really widespread, and you needed funky certificates like the one in the original link because you had no way to predict if someone was trying to access google.com or facebook.com and you risked generating a browser warning if you offered up the wrong one.