DataTerminology.comNEW
Also known as: SAN
An X.509 extension listing additional identities (DNS names, IP addresses, URIs) bound to a certificate’s subject.
DESCRIPTION
Subject Alternative Name (SAN) extends X.509 certificates with extra identifiers to support multiple hostnames or services. Modern TLS stacks validate hostnames against SAN rather than Common Name, improving flexibility and security. SAN entries can include DNS names, IP addresses, URIs, and email addresses. Proper SAN configuration is essential for multi-domain certificates, load balancers, and microservices. Misconfigured SANs cause validation failures and connection errors.
ALTERNATIVE DEFINITIONS
IETF RFC 5280
The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in the subject field or may be contained in the subjectAltName extension.
Defines SAN formally within the X.509 standard context.
Mozilla
Hostname verification must be performed against the Subject Alternative Name DNSName entries, not the Common Name.
Emphasizes modern hostname validation practice using SAN.
DigiCert
The Subject Alternative Name (SAN) field lets you specify additional hostnames, IP addresses, and other identifiers for a certificate.
Practical guidance for specifying SAN entries in certificates.
RELATED TERMS
X.509 Certificate Certificate Authority TLS Public Key Infrastructure Certificate Extension Hostname Validation OpenSSL
COMPETING TERMS
Common Name
KNOWLEDGE AREAS
TARGET AUDIENCE
Security Architect Cybersecurity Engineer DevOps Engineer Cloud Architect Application Administrator Chief Information Security Officer IT Auditor
EXTERNAL SOURCES
- Wikipedia - X.509
- IETF - X.509 certificate profile
- OpenSSL - SAN configuration options
- DigiCert - Certificate SAN quick reference
TOP QUESTIONS
Why is Subject Alternative Name preferred over Common Name?
Modern TLS verifies hostnames against SAN, supporting multiple identities and reducing misconfiguration risks.
Category: Relevancy
What identifiers can Subject Alternative Name include?
DNS names, IP addresses, URIs, email addresses, and directory names.
Category: Overview
How do you configure Subject Alternative Name in certificates?
Specify SAN entries in CSR or config files, using x509v3 extensions via tools like OpenSSL.
Category: Requirements
What are common mistakes with Subject Alternative Name?
Omitting required DNS names, mixing CN validation assumptions, and invalid IP entries cause verification failures.
Category: Mistakes
What risks arise from incorrect Subject Alternative Name settings?
Connection errors, reduced trust, and potential MITM exposure if validation falls back incorrectly.
Category: Risk
What competes conceptually with Subject Alternative Name?
Common Name was historically used, but SAN is the modern, standard approach.
Category: Alternatives
How does Subject Alternative Name support microservices?
SAN allows certificates to cover multiple service hostnames or IPs in distributed environments.
Category: Example
Is wildcard use compatible with Subject Alternative Name?
Yes; SAN entries can include wildcard DNS names if permitted by policy.
Category: Opinion
Where to find Subject Alternative Name standards?
IETF RFC 5280 defines SAN; OpenSSL docs provide configuration details.
Category: GettingStarted