Optional comma-separated list of DNS Subject Alternative Names (SANs), e.g. api.example.com,service.example.com.

Each value must be allowed by the PKI role's allowed_domains setting. Leave blank if no additional DNS SANs are required.