DE EN IT

~/glossary / Web & TLS

SAN (Subject Alternative Name)

The SAN (Subject Alternative Name) is the TLS certificate field that lists all hostnames, and optionally IP addresses, the certificate is valid for.

daniele@mikweb: ~/glossary — man subject-alternative-name

One certificate can carry many names, for example example.com, www.example.com and cloud.example.com. Browsers have checked only the SAN list for years; the Common Name (CN) is ignored. A certificate whose name appears only in the CN is treated as invalid.

Wildcards such as *.example.com cover exactly one label: cloud.example.com yes, example.com and a.b.example.com no. That is why the apex is usually added as an extra SAN.

Typical mistake: a new hostname is added in DNS and the web server, but the certificate is not reissued. The browser then reports NET::ERR_CERT_COMMON_NAME_INVALID.

Example

openssl x509 -in fullchain.pem -noout -ext subjectAltName
daniele@mikweb: ~/glossary — ls

Related terms

Certificate chainA certificate chain is the sequence of server certificate, one or more intermediate certificates and the root CA that a client uses to verify authenticity.SNI (Server Name Indication)SNI (Server Name Indication) is a TLS extension where the client names the requested hostname during the handshake, so the server can pick the right certificate.ACMEACME (Automatic Certificate Management Environment) is the protocol for requesting, validating and renewing certificates automatically, best known from Let's Encrypt.TLSTLS (Transport Layer Security) is the protocol that encrypts connections and proves the server's identity with certificates; it replaced SSL.

← All terms