SAN
acronymcryptographysecurity
Stands for: Subject Alternative Name
The certificate field listing all hostnames the certificate is valid for.
Subject Alternative Name (RFC 5280) is the X.509 extension that carries the domains a certificate covers. Modern browsers ignore the old Common Name and validate against the SAN list, so a certificate must name every hostname it serves there.
The Subject Alternative Name extension is where a certificate's valid names actually live. The Common Name field that once held the hostname is long deprecated for this purpose, and browsers stopped consulting it years ago, so a certificate whose name appears only in the CN will be rejected no matter how correct it looks.
A SAN list can hold several names of several types: DNS names, IP addresses, and email addresses among them. That is what makes one certificate serve many hostnames, and it is why a wildcard entry and specific entries can coexist in the same certificate. It is also the field to inspect first when a certificate is rejected for a name it obviously covers, because the name is often present in the CN and absent from the SAN list.
Two details bite in practice. A wildcard matches exactly one label, so a certificate for a wildcard subdomain does not cover a deeper subdomain beneath it. And every name in the list is published in certificate transparency logs, so internal hostnames included in a public certificate become publicly enumerable, which is a genuine reconnaissance gift and an argument for private PKI on internal names.
Also known as: san