Hi Derek,
Many thanks for your email, it has helped me a lot for troubleshooting my certificates issues on my homelab.
I don't know if you solved the san issue, but I have made it work using --san=DNS:
host.na.me I found this somewhere although I can't remember where (probably in between my hundreds tabs).
Thanks again,
Kind regards.
Timothe 'NokiDev' Van Deputte