Sorry, I thought you were following the manual method as explained in Using Let's Encrypt in manual mode
and that you were trying (originally to do the step)
openssl req
-new -newkey rsa:2048 -sha256 -nodes
-keyout privkey1.pem -out signreq.der -outform der
-subj "/C=UK/ST=Some State/L=Some Place/O=example.com/emailAddress=webmaster@example.com/CN=example.com"
-reqexts SAN
since you were asking about the SAN. My comment about the -config was on that line ( for openssl) and not the LE scrypt.