Yes, you need both www and the non-domain on your certificate. Regardless of which one you use, users who type the other will need to make an HTTPS connection to your server before they can be redirected.
All CertSimple certificates include a minimum of three domains, enough to include both a non-www, a www and another name (maybe an onion?) on the certificate. You can also add new names any time you like, discounted for the remaining time on your certificate.