It could be nice to add option to request https certificate from already found subdomains and check if any of them has additional subject alt names. I did only fast scroll through code so sorry if it already does this