existing https certificate add wildcard - https

Question

Sorry if duplicate, poked around but couldn't find anything.
I have 4 URLs that I'd like to use the same certificate for.
dev.myapp
qa.myapp
dr.myapp
myapp
I got a certificate for the wildcard *myapp. I am testing this in dev, however this doesn't seem to work, AWS has told me that the wildcard should be *.myapp
Couple questions on this.
1) Can I change the existing certificate to use the wildcard *.myapp? But will this work in my prod "myapp" env?
2) Is the right way to do this to have two wildcards *myapp and *.myapp? The same question applies if I can ADD a wildcard to the existing certificate.

Answer 1

You can't change an issued certificate. No one can; if they could the whole system would be insecure.
What you maybe can do is have the CA issue a new and (somewhat) different cert to replace the problematic one. Many probably most CAs have provisions for doing this without repeating the identity and/or domain 'ownership' proofs and without additional fee (if any), but details vary depending on the CA and sometimes the features you purchased, which you have carefully not identified, making a specific answer impossible.
Also I assume the names you gave are falsified, because myapp is not a TLD, if it were you would not control it, and no-one at all can ever control a suffix of TLDs. Assuming your actual names are something more like:
1 example.com
2 dev.example.com
3 qa.example.com
4 dr.example.com
and you are the 'owner' of (or at least control) example.com, then a wildcard cert *.example.com matches 2-4 but not 1. There is no wildcard that matches all four.
However, SSL/TLS certificates (including HTTPS) are not limited to a single name: they support the SubjectAlternativeNames extension which can have multiple names. This is commonly abbreviated SAN, and also called 'multi-domain' or in the Microsoft world 'UCC'. In past decades CAs often charged extra for this, but in recent years it has become commonly included in the basic service. For example if you purchase/request a cert for www.example.com many CAs nowadays will actually give you SAN=www.example.com,example.com automatically. (To be exact, SAN=dnsName:www.example.com,dnsName:example.com because SAN can also do some other things that aren't relevant to SSL/TLS/HTTPS.)
For your case, SAN=example.com,*.example.com would accomplish what you want. So would SAN=example.com,dev.example.com,qa.example.com,dr.example.com, although that would 'expose' your subdomain names to anyone who monitors and/or starts a connection to your server. Check with your CA to see if they will issue you a new cert in one of these forms.