the certificate they "build" for you, only extents as far as *.domain or *.sub.domain whichever of the 2 you use first, which of the time is the first one. If you want the second option as well you need to get their advanced certificate addon which is $10 a month, then you can generate a second cert having the correct domains. Or disable the proxy feature and use lets encrypt for it.