I have my own X.509 CA. When issuing certificates for hosts, if I have
do I still have to put
DNS:foobox.grawity.tld as a subjectAltName?
(I noticed that Chrome sometimes uses the first sAN instead of the subject common name in error messages.)