diff --git a/docs/insecure.md b/docs/insecure.md
index 73dafbe7a..3446a85f3 100644
--- a/docs/insecure.md
+++ b/docs/insecure.md
@@ -68,6 +68,7 @@ This is more secure than the insecure registry solution.
 
     $ openssl req \
       -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
+      -addext "subjectAltName = DNS:myregistry.domain.com" \
       -x509 -days 365 -out certs/domain.crt
     ```