I did a short write-up on how to generate self-signed SAN (Secondary Alternate Name) certificates for ctrlX CORE. See attached.
This set-up allowed me to display the ctrlX CORE web UI in an iframe (context: WebIQ) without separately creating a manual exception for the standard certificate.