diff --git a/jupyterhub/spawner.py b/jupyterhub/spawner.py
index ad1c4c6d..90bcf006 100644
--- a/jupyterhub/spawner.py
+++ b/jupyterhub/spawner.py
@@ -750,7 +750,8 @@ class Spawner(LoggingConfigurable):
         """
         from certipy import Certipy
         default_names = ["DNS:localhost", "IP:127.0.0.1"]
-        alt_names = self.ssl_alt_names or []
+        alt_names = []
+        alt_names.extend(self.ssl_alt_names)
 
         if self.ssl_alt_names_include_local:
             alt_names = default_names + alt_names
diff --git a/jupyterhub/user.py b/jupyterhub/user.py
index 947dd3ca..74003ed2 100644
--- a/jupyterhub/user.py
+++ b/jupyterhub/user.py
@@ -229,6 +229,12 @@ class User:
         client_id = 'jupyterhub-user-%s' % quote(self.name)
         if server_name:
             client_id = '%s-%s' % (client_id, quote(server_name))
+
+        trusted_alt_names = []
+        trusted_alt_names.extend(self.settings.get('trusted_alt_names', []))
+        if self.settings.get('subdomain_host'):
+            trusted_alt_names.append('DNS:' + self.domain)
+
         spawn_kwargs = dict(
             user=self,
             orm_spawner=orm_spawner,
@@ -239,7 +245,7 @@ class User:
             db=self.db,
             oauth_client_id=client_id,
             cookie_options = self.settings.get('cookie_options', {}),
-            trusted_alt_names=self.settings.get('trusted_alt_names'),
+            trusted_alt_names=trusted_alt_names,
         )
 
         if self.settings.get('internal_ssl'):