SAN Certificate (Subject Alternative Name)

A SAN (Subject Alternative Name) certificate includes an extension that lists every hostname it is valid for, such as example.com, www.example.com and shop.example.net. Modern browsers match the hostname against the SAN list only; they no longer fall back to the Common Name field.

Why it matters

One certificate and one renewal can cover several sites, which reduces the number of expiry dates you must track. It also means a missing name causes a "certificate name mismatch" error (NET::ERR_CERT_COMMON_NAME_INVALID in Chrome) even though the certificate itself is valid.

Example

You can read the SAN list from a live server:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName

Output looks like DNS:example.com, DNS:www.example.com. The apex and www are separate names, and both must appear.

Common mistakes

• Securing www.example.com but not the bare example.com, so one of them shows a name mismatch.
• Adding a new subdomain to DNS without reissuing the certificate with that name.
• Putting unrelated clients' domains on one certificate, which exposes the full list to anyone who inspects it.
• Assuming a SAN certificate is the same as a wildcard. A SAN lists exact names unless it includes wildcard entries.

Related

• Wildcard certificate
• Certificate authority
• Apex domain
• Guide: SSL certificate types explained
• Tool: SSL checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.