These notes assume that you already have an app service plan running a number of sites (web apps) that ALL want the same wildcard cert.
The problem being solved was how to point a number of sites to a company domain.
The aliases (e.g. alias trainer.foo-uk.com
onto CNAME pvb-live-eun-trainer-as.azurewebsites.net
) MUST already be configured in DNS -- Azure will check!