Simple definition
The SAN (Subject Alternative Name) is the X.509 certificate extension that lists the DNS names, IP addresses, or other identities for which the certificate is valid.
Technical definition
Modern TLS clients validate the requested name against the certificate SAN entries. Each identity must use the appropriate type, such as DNS for a hostname or IP for an IP address.
How it works / role
During the TLS handshake, the server presents its certificate. The client validates the trust chain and validity dates, then compares the connection name with the SAN entries. If no compatible entry matches, a certificate name error is raised.
What is it used for?
Allow one certificate to cover several service names while giving clients an explicit list of valid identities.
Practical example
A web certificate contains example.fr and www.example.fr in its SAN extension so both URLs are recognized as valid.
Common issues
- The DNS name used by clients is missing from the SAN entries
- A wildcard is misunderstood or does not cover the expected hostname
- An IP address is added as a DNS name instead of an IP-type entry
- The certificate was issued for the wrong environment or an outdated name list
Key takeaway: For TLS name errors, inspect the SAN entries actually present in the certificate instead of relying only on the common name.