A Subject Alternative Name (SAN) is an X.509 certificate extension that lists identifiers for the certificate’s public-key owner. It extends the Subject field, which identifies the main person, organization, or server, with additional DNS names, email addresses, IP addresses, or URIs. For web certificates, SAN provides the names that clients use to identify the server. section 8.1.4 section 8.4
Use SAN deliberately when naming a certificate:
- Add multiple DNS names when one certificate serves more than one hostname. section 8.1.4
- Prefer stable DNS names over IP addresses; IP addresses can be reassigned and reused, so they do not reliably identify the server owner. section 8.3
- Include SAN in a server certificate rather than relying only on the Subject common name; browsers can report an error when SAN is absent. section 9.2.3
One certificate, two web names
A GitHub certificate uses `github.com` as its Subject common name and lists both `github.com` and `www.github.com` as DNS SAN entries. The Subject identifies the primary owner; SAN records the names the certificate also covers. section 8.1.4
Listing 9.5 OpenSSL configuration file ca/server-cert.cnf
[ req ] distinguished_name = req_distinguished_name req_extensions = req_ext x509_extensions = v3_ca prompt = no [ req_distinguished_name ] C = Canada ST = Ontario L = Toronto O = Adib Saikali OU = MacBook Pro CN = localhost [ req_ext ] subjectAltName = @alt_names [ v3_ca ] subjectAltName = @alt_names [ alt_names ] DNS.1 = localhost
A small OpenSSL configuration shows how to define SAN entries for a local server certificate. The configuration names `localhost` under `alt_names`, then exposes that list through the certificate-request extensions. section 9.2.3
