Certificates & Formats

What Is Subject Alternative Name (SAN)?

A Subject Alternative Name (SAN) is an X.509 certificate extension that lists the identities — DNS names, IP addresses or email addresses — the certificate is valid for. Modern browsers and TLS clients match the hostname exclusively against the SAN list; the older Common Name (CN) field is ignored.

Why SANs replaced the Common Name

Historically a certificate identified one hostname in its Common Name (CN). That never scaled to modern deployments — one service answering on www.example.com, example.com and api.example.com — so RFC 2818 and later RFC 6125 moved hostname matching to the SAN extension, which can hold many names. Chrome stopped trusting CN-only certificates in 2017, and every public CA now requires all hostnames as SANs.

Practical consequence: if a name is not in the SAN list, the certificate does not cover it — no matter what the CN says. The classic symptom is NET::ERR_CERT_COMMON_NAME_INVALID even though the CN "looks right".

Types of SAN entries

DNS names are the common case, including wildcards like *.example.com (which covers one label level — app.example.com but not a.b.example.com). IP addresses are allowed technically but rejected by many CA policies and flagged by compliance checks. Email addresses appear in S/MIME certificates, and URIs/UPNs appear in specialized enterprise certificates such as smart-card logon.

SANs in CSRs — where orders go wrong

The SAN list must be present in the Certificate Signing Request (or added by the CA portal) — and a surprising share of failed certificate orders trace back to a CSR that only set the CN. Best practice: include every hostname as a SAN in the CSR, repeat the CN value as a SAN, and decode the CSR before submitting it to verify the list is complete.

Try it yourself — free tools

CSR Decoder & Analyzer — decode a CSR and verify its SAN list before you submit it to the CA
Certificate Checker — see exactly which SANs a live certificate covers
CSR Generator — generate a CSR with all hostnames correctly listed as SANs

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.