You need two certs: 1. CN=example.com 2. CN=*.example.com If all you are using the secondary cert for is to provide a TLS signing token you can get away with

You need two certs: 1. CN=example.com 2. CN=*.example.com If all you are using the secondary cert for is to provide a TLS signing token you can get away with just a cert for the domain. You have to play some tricks with DNS and hostnames, if you are spreading services between different machines (and it's hokey to do it that way if you want to be a service provider) but it can be made to work.