Contents
What is a subject alternative name certificate?
The Subject Alternative Name (SAN) is an extension to the X. 509 specification that allows users to specify additional host names for a single SSL certificate. The use of the SAN extension is standard practice for SSL certificates, and it’s on its way to replacing the use of the common name.
What is an alternative name?
An ‘alternate name’ or ‘nickname’ is a name that you go by or give to a friend that is not your own or their own name.
What is subject name?
Subject Name means the information of the name of certificate holder.
Which is SSL clients support Subject Alternative names?
If a SSL Certificate has a Subject Alternative Name (SAN) field, then SSL clients are supposed to ignore the Common Name value and seek a match in the SAN list. This is why DigiCert always repeats the common name as the first SAN in our certificates. Which SSL Clients Support Subject Alternative Names?
Can a SSL certificate ignore the common name?
It’s a safe bet that all SSL clients will support exact common name matching. If a SSL Certificate has a Subject Alternative Name (SAN) field, then SSL clients are supposed to ignore the Common Name value and seek a match in the SAN list.
How to access client certificate’s subject alternative name ( San ) field?
I’d really rather do this at the Nginx layer as opposed to passing the cert down to the application layer and doing it there. Any help much appreciated. You can do it through OpenResty + Lua-OpenSSL and parse the raw certificate to get it. Refer this: https://github.com/Seb35/nginx-ssl-variables/blob/master/COMPATIBILITY.md#ssl_client_s_dn_x509
How do common names ( CN ) and Subject Alternative names ( San ) work?
How do Common Names (CN) and Subject Alternative Names (SAN) work together? Assuming the Subject Alternative Name (SAN) property of an SSL certificate contains two DNS names but the Common Name (CN) is set to only one of both: CN=domain.tld.