diff --git a/packages/apps/mariadb/templates/certmanager.yaml b/packages/apps/mariadb/templates/certmanager.yaml
index c28892f47..df17d2797 100644
--- a/packages/apps/mariadb/templates/certmanager.yaml
+++ b/packages/apps/mariadb/templates/certmanager.yaml
@@ -47,8 +47,8 @@ spec:
     secretName: {{ .Release.Name }}-ca-tls
 ---
 # Leaf server TLS Certificate passed to mariadb-operator via spec.tls.serverCertSecretRef.
-# The SAN list covers the primary and secondary services plus, when external is true,
-# the external DNS name for the LoadBalancer service.
+# The SAN list covers the base, primary, and secondary services plus, when external is
+# true, the external DNS name for the LoadBalancer service.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -69,7 +69,7 @@ spec:
     - localhost
     - {{ printf "*.%s-internal.%s.svc" $name $ns | quote }}
     - {{ printf "*.%s-internal.%s.svc.%s" $name $ns $clusterDomain | quote }}
-    {{- range $svc := list (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
+    {{- range $svc := list $name (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
     - {{ $svc }}
     - {{ $svc }}.{{ $ns }}.svc
     - {{ $svc }}.{{ $ns }}.svc.{{ $clusterDomain }}
diff --git a/packages/apps/mariadb/tests/tls_test.yaml b/packages/apps/mariadb/tests/tls_test.yaml
index e485117a9..01f0e9258 100644
--- a/packages/apps/mariadb/tests/tls_test.yaml
+++ b/packages/apps/mariadb/tests/tls_test.yaml
@@ -142,6 +142,15 @@ tests:
       external: true
     documentIndex: 3
     asserts:
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc.cluster.local"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"
@@ -253,6 +262,9 @@ tests:
       - notContains:
           path: spec.dnsNames
           content: "my-mariadb.example.com"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"