Certbot picks up wrong CN from the SAN list while renewing/creating cert

[webprofusion]

This doesn't appear to be an option in certbot, but I think you can do it if you provide your own CSR:

Domain ordering not respected, unexpected certificate subject

P…

Consider whether to add a flag to control whether the CSR contains a Subject CN

It can be done in some other ACME clients.