# What Is Common Name (CN)? Definition and Examples

> Common Name (CN) is the subject attribute that once held a certificate's hostname; browsers now ignore it and match names only against the SAN list.

Source: https://ssl.sh/glossary/common-name/
Last updated: 2026-11-10

The common name is one attribute of a certificate's [distinguished name](https://ssl.sh/glossary/distinguished-name/), written `CN=example.com`. Early HTTPS clients compared the requested hostname with the CN, but RFC 2818 already deprecated that practice in 2000 in favour of the [Subject Alternative Name](https://ssl.sh/glossary/san/) extension. Chrome stopped falling back to the CN in Chrome 58 (2017); modern browsers match only against the SAN, and many TLS libraries have dropped the CN fallback too.

## Why it matters
Under the Baseline Requirements the CN is optional, and if a publicly trusted certificate includes one, its value must also appear in the SAN list. A certificate whose hostname exists only in the CN, typical of hand-made self-signed certificates, fails in browsers with errors such as [NET::ERR_CERT_COMMON_NAME_INVALID](https://ssl.sh/errors/net-err-cert-common-name-invalid/). Despite the error's name, the fix is to add the hostname to the SAN. Old guides that simply say "set the CN to your domain" are incomplete for this reason.

## Example
```bash
openssl x509 -in cert.pem -noout -subject -ext subjectAltName
```

If the output shows `subject=CN=example.com` but the SAN is missing or lacks `DNS:example.com`, browsers will reject the certificate for that name.

## Common misconceptions
- **The CN must match the hostname.** Only the SAN matters to modern clients; a matching CN does not help if the SAN does not cover the name.
- **ERR_CERT_COMMON_NAME_INVALID means the CN is wrong.** It means the requested hostname is not covered by the certificate's SAN entries, for example visiting `www.example.com` with a certificate issued only for `example.com`.

## Related terms

- [DN](https://ssl.sh/zh/glossary/distinguished-name/): DN 即可分辨名称，是由 C、O、CN 等属性组成的 X.500 风格结构化名称，用来标识 X.509 证书的主体和颁发者。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CSR](https://ssl.sh/zh/glossary/csr/): CSR 是证书签名请求，包含申请者的公钥和希望写入证书的身份信息，用私钥签名后提交给 CA 以申请证书。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [多域名证书](https://ssl.sh/zh/glossary/multi-domain-certificate/): 多域名证书是在 SAN 扩展中列出多个不同主机名、让一张证书同时保护多个域名的 TLS 证书。