Subject Alternative Names (SANs)

Add Subject Alternative Names to a production certificate with the --sans flag. All other settings remain explicit CLI flags—no dc-acme.toml.

Command pattern

The Common Name is the primary domain; --sans lists additional hostnames as a comma-separated string (no spaces after commas). SANs are often a mix of names on the same base domain and names on entirely different domains—for example, a primary site plus a legacy hostname, a partner subdomain, or a separate brand:

# Production request with SANs — DNS-01 + NGINX install (replace placeholder values)
sudo dc-acme request enroll \
  --directory-url "https://one.digicert.com/mpki/api/v1/acme/v2/directory" \
  --email "admin@example.com" \
  --eab-key "YOUR_EAB_KEY_ID" \
  --eab-hmac "YOUR_EAB_HMAC_KEY" \
  --auto-ari-renew=true \
  --cn "example.com" \
  --sans "www.example.com,api.example.com,portal.othercompany.com,status.partner.net" \
  --challenge-type "dns-01" \
  --challenge-handler-name "default" \
  --challenge-handler-args "DNS_PROVIDER_NAME=route53,AWS_ACCESS_KEY_ID=YOUR_AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY=YOUR_AWS_SECRET_ACCESS_KEY,AWS_REGION=us-east-1" \
  --installer-handler-name "nginx" \
  --installer-handler-args "identifier=example.com"

DCV covers every name. The client must validate each identifier on the certificate—here, example.com, www.example.com, api.example.com, portal.othercompany.com, and status.partner.net. With DNS-01, that means a challenge record in the DNS zone for each name (or its parent zone). Your handler credentials must be able to write records in every zone involved.

HTTP-01 is not practical for this pattern. HTTP-01 requires each name to resolve to a host that can serve the token on port 80. That works when every SAN is an alias of the same server, but it breaks down when SANs span different base domains, brands, or DNS zones—you would need separate reachable endpoints (or awkward redirects) for each name. For multi-domain SAN lists like this, use DNS-01.

Adding SANs after the first certificate

Whether you can add a hostname later depends on whether the certificate uses a wildcard Common Name.

Certificate type	Add a SAN on the same ACME order?	What happens if you try
Non-wildcard (`example.com`)	No	A re-enroll with a different `--sans` list is treated as a new enrollment—a new, billable order. A forced `reissue` with extra `--sans` does not add the name (the flag is ignored).
Wildcard (`*.example.com`)	Yes (while `--cn` stays `*.example.com`)	DigiCert typically reissues the existing wildcard order with the updated SAN list. Additional charges may apply for new names. Each added name still requires DCV.

Plan non-wildcard names up front. For a standard (non-wildcard) certificate, list every FQDN on the first enroll—--cn plus the full --sans list. You cannot grow the SAN list on the existing order later.

Non-wildcard certificates

DigiCert treats the Common Name and SAN list as fixed when the ACME order is created. After the first certificate is issued:

Re-enroll with the same --cn and an expanded --sans list → auto-detection sees a different SAN set → new enrollment → new billable order. Include every name you need (old and new) in that request.
Forced reissue (?action=reissue&orderId= or --cc-order-action reissue) with --sans → the reissue may succeed, but the new --sans value is ignored—you get the original name set only. Do not use this path to add hostnames.

There is no supported workflow to attach an extra SAN to an existing non-wildcard ACME order.

Wildcard certificates

Wildcard orders are more flexible. While --cn remains the same wildcard (for example *.example.com), you can add or remove names in --sans on a later enroll—DigiCert typically matches the existing order and reissues with the updated SAN list.

# Add a SAN to an existing *.example.com order (replace placeholder values)
sudo dc-acme request enroll \
  --directory-url "https://one.digicert.com/mpki/api/v1/acme/v2/directory" \
  --email "admin@example.com" \
  --eab-key "YOUR_EAB_KEY_ID" \
  --eab-hmac "YOUR_EAB_HMAC_KEY" \
  --auto-ari-renew=true \
  --cn "*.example.com" \
  --sans "api.example.com,legacy.example.com" \
  --challenge-type "dns-01" \
  --challenge-handler-name "default" \
  --challenge-handler-args "DNS_PROVIDER_NAME=route53,AWS_ACCESS_KEY_ID=YOUR_AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY=YOUR_AWS_SECRET_ACCESS_KEY,AWS_REGION=us-east-1"

DCV must succeed for every new name in --sans.
Billing: Additional SANs on a wildcard order may incur additional charges in CertCommand. Confirm the updated order under Certificates > Orders.

See Wildcard certificates for wildcard-specific patterns (including deploying the same wildcard on multiple servers).

Forcing enroll vs. reissue

To override auto-detection explicitly, append ?action=enroll or ?action=reissue&orderId= to your ACME Directory URL—see ACME Automation Actions. Forcing reissue on a non-wildcard order does not add SANs; use a new enroll with the complete name list when you need more hostnames on a non-wildcard certificate—this creates a new, billable order.

Auto-detection Rules — How DigiCert matches enroll, reissue, and new orders
NGINX with DNS-01 — Full DNS-01 walkthrough
Wildcard certificates — Wildcard CN with DNS-01
Production CLI Examples — All CLI-only recipes

← Back to Production CLI Examples