Request san cert for some domains

I am trying to request certificates with auto-ssl for use behind Cloudfront for some domains. Cloudfront [requires ssl certificate to cover the origin domain name plus the domain requested via the host header](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-cloudfront-to-custom-origin.html).

> The certificate returned from the origin must cover the domain that you specified for Origin Domain Name for the corresponding origin in your distribution. In addition, if you configured CloudFront to forward the Host header to your origin, the origin must respond with a certificate matching the domain in the Host header.

I am currently using `allow_domain` to control which certs are generated and `request_domain` to return the origin cert in certain cases. However, I do not see a hook for specifying which domains are requested for the certificate. Is there any way to specify an additional domain to include in the certificate?

Start by tracing how allow_domain and request_domain are handled during certificate requests. Determine where an additional requested domain could be configured for the CloudFront use case, and define completion as producing a certificate that covers both the origin domain and the forwarded Host header domain.

Written by the indexing model from the issue text.