中文

Glossary

Multi-Domain Certificate (SAN certificate / UCC (Unified Communications Certificate))

Last verified

Definition

Multi-domain certificates are TLS certificates that list several distinct hostnames in the SAN extension, so one certificate secures all of them.

A multi-domain certificate, also sold as a SAN certificate or UCC (Unified Communications Certificate), is an ordinary X.509 TLS certificate whose Subject Alternative Name extension contains more than one DNS name. The names need not share a parent domain: example.com, www.example.com, example.net and mail.example.org can all appear in one certificate, and some CAs also allow wildcard entries alongside them. The UCC label comes from its common use with Microsoft Exchange and other unified communications servers that answer on several hostnames.

Why it matters

One certificate and one key can serve several sites or services on the same server, which simplifies deployment where SNI is unavailable or many names share one endpoint. Browsers match the requested hostname only against SAN entries; Chrome stopped falling back to the common name in Chrome 58, so every name must be in the SAN list. Each name must be validated separately, and adding or removing a name means reissuing the certificate.

Example

openssl req -new -key example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com,DNS:example.net"
openssl x509 -in example.com.crt -noout -ext subjectAltName

Common misconceptions

  • The common name is enough. Modern clients ignore CN for hostname matching; list every name in SAN, including the one in CN.
  • All names must belong to the same company. For DV, the applicant only needs to prove control of each name.
  • The extra names are private. Every name is visible to anyone who views the certificate and is published in Certificate Transparency logs.

See also