diff --git a/docs/04-certificate-authority.md b/docs/04-certificate-authority.md
index f8842d9..5114686 100644
--- a/docs/04-certificate-authority.md
+++ b/docs/04-certificate-authority.md
@@ -303,6 +303,8 @@ KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-har
   --region $(gcloud config get-value compute/region) \
   --format 'value(address)')
 
+KUBERNETES_SAN=kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster,kubernetes.svc.cluster.local
+
 cat > kubernetes-csr.json <<EOF
 {
   "CN": "kubernetes",
@@ -326,7 +328,7 @@ cfssl gencert \
   -ca=ca.pem \
   -ca-key=ca-key.pem \
   -config=ca-config.json \
-  -hostname=10.32.0.1,10.240.0.10,10.240.0.11,10.240.0.12,${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,kubernetes.default \
+  -hostname=10.32.0.1,10.240.0.10,10.240.0.11,10.240.0.12,${KUBERNETES_PUBLIC_ADDRESS},127.0.0.1,${KUBERNETES_SAN} \
   -profile=kubernetes \
   kubernetes-csr.json | cfssljson -bare kubernetes