openssl req -new -sha256 -key /etc/ssl/private/<domain>.key \
    -subj "/CN=<domain1>" -config <domain>-san.conf > <domain>.csr
chmod 640 <domain>.csr