Subject alternative name

The common name was a single field in the certificate's subject, holding one hostname. It predates the idea that one certificate might cover several names.

The SAN extension was introduced to hold a list, and clients were expected to prefer it.

Chrome removed common name fallback in 2017 and other browsers followed, so a certificate with a common name and no SAN is rejected outright.

Authorities now copy the first SAN entry into the common name for compatibility with old software, which is why the field still appears and still misleads.

The match is exact, on the full hostname. `example.com` in the list does not cover `www.example.com`, and the reverse is equally true.

A wildcard entry such as `*.example.com` covers exactly one level: `www.example.com` and `api.example.com`, but not `example.com` itself and not `a.b.example.com`.

Internationalized names appear in their Punycode form, and a comparison against the Unicode form will not match.

IP addresses can appear as SAN entries of a different type, which is unusual on the public web and common on internal infrastructure.

Matching is case-insensitive on the hostname, and a trailing dot in the requested name is stripped before comparison. Neither detail rescues a name that is genuinely absent from the list.

The apex omitted from a `www` certificate: anyone typing the bare domain hits a warning before the redirect to `www` can run. The redirect is served over the connection that already failed.

A subdomain added later — an API, a staging host promoted to production, a marketing microsite — and never added to the certificate.

A domain acquired or migrated, where DNS points at the new server before the certificate covers the old name.

In every case the site itself is fine. The failure happens before a single byte of HTTP is exchanged.

Because it fails during the handshake, no redirect, no canonical tag and no security header can help: none of them has been received yet.

`openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName` prints the list.

Compare it against every hostname that resolves to the site, including ones that only exist to redirect.

Test each name with `curl -I https://<name>/`. A certificate error is reported plainly, and `-v` shows which name was expected.

Re-check after adding any hostname. Adding a DNS record is one step; adding it to the certificate is the other, and only the first is usually remembered.