Common Name (CN)

The common name is one attribute of a certificate's distinguished name, written CN=example.com. Early HTTPS clients compared the requested hostname with the CN, but RFC 2818 already deprecated that practice in 2000 in favour of the Subject Alternative Name extension. Chrome stopped falling back to the CN in Chrome 58 (2017); modern browsers match only against the SAN, and many TLS libraries have dropped the CN fallback too.

Why it matters

Under the Baseline Requirements the CN is optional, and if a publicly trusted certificate includes one, its value must also appear in the SAN list. A certificate whose hostname exists only in the CN, typical of hand-made self-signed certificates, fails in browsers with errors such as NET::ERR_CERT_COMMON_NAME_INVALID. Despite the error's name, the fix is to add the hostname to the SAN. Old guides that simply say "set the CN to your domain" are incomplete for this reason.

Example

openssl x509 -in cert.pem -noout -subject -ext subjectAltName

If the output shows subject=CN=example.com but the SAN is missing or lacks DNS:example.com, browsers will reject the certificate for that name.

Common misconceptions

• The CN must match the hostname. Only the SAN matters to modern clients; a matching CN does not help if the SAN does not cover the name.
• ERR_CERT_COMMON_NAME_INVALID means the CN is wrong. It means the requested hostname is not covered by the certificate's SAN entries, for example visiting www.example.com with a certificate issued only for example.com.