SAN (Subject Alternative Name)
SAN (Subject Alternative Name) is an X.509 certificate extension, defined in RFC 5280, that lists every hostname (and optionally IP address) a certificate is valid for, as one or more DNS name entries attached to the certificate alongside its subject field. Modern browsers and TLS libraries check the SAN list, not the certificate's subject Common Name, to decide whether a certificate matches the hostname being connected to -- the CN field is effectively legacy and ignored for this purpose in current clients, a change the CA/Browser Forum's baseline requirements formalized industry-wide. A single certificate's SAN list can cover multiple distinct hostnames, including a wildcard entry like *.example.com alongside the bare apex domain, which is how one certificate commonly serves both a site and its subdomains. A certificate presented for a hostname absent from its SAN list fails hostname verification even if every other part of the chain is valid.
By AdminKit team, Netbase JSC · Updated