I am building a web site with HTTPS. The host has both a DNS name and an IP address and I'd like the SSL certificate(s) to cover both. I've been given a certificate that is signed by a trusted party - but this certificate does not include the DNS name (there's no Subject Alternative Name etc), only the IP address. I also have a CSR used to create this certificate and the private key used with this CSR.
Now, is there a way, given the assets I have, to create a new certificate, valid for both DNS name and IP address, that is trusted via chaining ultimately to the trusted party? In other words, can I somehow use the certificate I have to sign a new trusted certificate? Am I right to suspect such operation would need the private key of the original CA, which I obviously do not have?
BTW, the server I'm setting up is running Ubuntu and nginx. I already have a working setup with a self-signed certificate. I'm using openssl for certificate manipulation.