title: Subdomain on CloudFront not working (certificate not accepted)
body: <ul>
  <li>In the Cert Manager I have a valid certificate, which includes the *.example.com domain.</li>
  <li>In CloudFront I have a distribution with HTTP to HTTPS redirect enabled and empty CNAME field.</li>
  <li>When I edit the distribution and enter staging.example.com in the CNAME field and select the certificate I get the following error:</li>
  </ul>
  
  <pre><code>com.amazonaws.services.cloudfront.model.InvalidViewerCertificateException: The certificate that is attached to your distribution doesn't cover the alternate domain name (CNAME) that you're trying to add. For more details, see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html#alternate-domain-names-requirements (Service: AmazonCloudFront; Status Code: 400; Error Code: InvalidViewerCertificate; Request ID: 8406d8d5-65c3-11e9-afc0-65457a0a2bea)
  </code></pre>
  
  <p>Am I missing something? The other distribution for the top level domain is working fine with the same certificate.</p>