KDE Certification Authority Tool » kCA certificate helper library

Subject Alternative Names (subjectAltName) is always a multi-value extension, but not created as such, if only one entry for the extension exists.

The low-level problem with this is to "know" if an extension is multi-value beforehand and correctly creating it as such even with only one value.

A hacky solution is to add the request's subject common name as a DNS-based entry, technically enforcing subjectAltName to be created as multi-value, but that does not work for every extension, so a better solution needs to be found here.