title: Generating a CSR for root domain (includes www or not?)
body: <p>I am trying to set up SSL for the first time.  I purchased my domain and SSL certificate from Gandi.net. Their docs say </p>
  
  <blockquote>
    <p>subdomain.example.com indicates the subdomain that you want to
    protect. This is the most important part. If you have a single-address
    certificate to activate, you should put in the full subdomain (e.g.
    foo.example.com). <strong>The www subdomain is added automatically by the CA,
    for example, example.com will secure both example.com and
    www.example.com</strong> If you have a wildcard certificate, you should put in
    a * for the subdomain (e.g. *.example.com). Wildcard certificates also
    secure the raw domain (with no subdomain).
    - <a href="http://wiki.gandi.net/en/ssl/csr">http://wiki.gandi.net/en/ssl/csr</a></p>
  </blockquote>
  
  <p>I am hosting my app on Heroku and their docs say:</p>
  
  <blockquote>
    <p>The Common Name field must match the secure domain. <strong>You cannot
    purchase a certificate for the root domain, e.g., example.com, and
    expect to secure www.example.com.</strong> The inverse is also true.
    Additionally, SSL Endpoint only supports one certificate per app.
    Please keep this in mind for multi-domain applications and specify a
    Common Domain that matches all required domains.
    - <a href="https://devcenter.heroku.com/articles/ssl-endpoint#acquire-ssl-certificate">https://devcenter.heroku.com/articles/ssl-endpoint#acquire-ssl-certificate</a></p>
  </blockquote>
  
  <p>These seem to conflict.  Please advise!</p>