These are the steps to get certificates for both `www` subdomain and the apex domain. It's a bit of a workaround, and the certificates may expire in the long run, but it is the only way I found to get all the options I wanted:
From this forum https://github.community/t5/GitHub-Pages/Does-GitHub-Pages-Support-HTTPS-for-www-and-subdomains/td-p/7116: GitHub doesn't currently support creating a certificate that covers both your root domain and your www subdomain. We only generate a certificate for the exact domain that you specify in the custom domain input box.
The other impetus for this is Github's recommendation that you use the www subdomain as the custom domain to take advantage of their CDN:
We strongly recommend that you use a www subdomain for these reasons:
Warning: If your domain has HTTPS enforcement enabled, GitHub Pages' servers will not automatically route redirects. You must configure www subdomain and root domain redirects with your domain registrar.
1. Set up apex domain
1. Configure your custom domain using an A record with your DNS provider. Point to one of the following servers:
2. Add custom apex domain to github pages, eg `townhallmaine.org`
3. Wait for SSL certificate to be issued, and then click `Enforce HTTPS` in your GitHub options.
2. Set up the www subdomain
1. Change the custom domain on github to the www subdomain. The url should continue to work, but now no longer served over HTTPS.
2. Change the default CNAME record that used to point `www` to `@` to point `www` to <githubname>.github.io
Follow your DNS provider's instructions to create a CNAME record that points your subdomain to your default pages domain. For example, if you own the subdomain www.example.com, you can configure a CNAME record to point www.example.com to YOUR-GITHUB-USERNAME.github.io. DNS changes can take over a full day to update, and the wait varies among DNS and hosting providers.
3. Wait again for the certificate to be issued, then reselect `Enforce HTTPS`.
Now all 4 domains should work: