GÉANT nos ha avisado de la adición de un nombre en cada solicitud de tipo "GÉANT OV SSL":

Colleagues, please be aware that when you order a GÉANT OV SSL certificate for a
name, such as mail.sample.example.org, in the Subject Alternative Names,
you get a correct entry for DNS:mail.sample.example.org but you also
get DNS:www.mail.sample.example.org. I have confirmed this by looking at
issued certificates in our SCM instance.

No such "bonus" SANs are added if you use GÉANT OV Multi-Domain. I have
confirmed this by looking at issued certificates in our SCM instance.

GÉANT has confirmed that this misfeature has been added to the GÉANT
issue log and will be brought up with Sectigo, and she asked me to bring
this issue to this list so you are aware of it.

Before this has been fixed, you might want to recommend to your
Organizations to use GÉANT OV Multi-Domain instead, even if they have no
additional SANs to request, or you might want to disabled GÉANT OV SSL.