# What Is Multi-Domain Certificate? Definition and Examples

> Multi-domain certificates are TLS certificates that list several distinct hostnames in the SAN extension, so one certificate secures all of them.

Source: https://ssl.sh/glossary/multi-domain-certificate/
Last updated: 2026-11-10

A multi-domain certificate, also sold as a SAN certificate or UCC (Unified Communications Certificate), is an ordinary X.509 TLS certificate whose [Subject Alternative Name](https://ssl.sh/glossary/san/) extension contains more than one DNS name. The names need not share a parent domain: `example.com`, `www.example.com`, `example.net` and `mail.example.org` can all appear in one certificate, and some CAs also allow wildcard entries alongside them. The UCC label comes from its common use with Microsoft Exchange and other unified communications servers that answer on several hostnames.

## Why it matters
One certificate and one key can serve several sites or services on the same server, which simplifies deployment where [SNI](https://ssl.sh/glossary/sni/) is unavailable or many names share one endpoint. Browsers match the requested hostname only against SAN entries; Chrome stopped falling back to the [common name](https://ssl.sh/glossary/common-name/) in Chrome 58, so every name must be in the SAN list. Each name must be validated separately, and adding or removing a name means reissuing the certificate.

## Example
```bash
openssl req -new -key example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com,DNS:example.net"
openssl x509 -in example.com.crt -noout -ext subjectAltName
```

## Common misconceptions
- **The common name is enough.** Modern clients ignore CN for hostname matching; list every name in SAN, including the one in CN.
- **All names must belong to the same company.** For DV, the applicant only needs to prove control of each name.
- **The extra names are private.** Every name is visible to anyone who views the certificate and is published in [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) logs.

## Related terms

- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [CN](https://ssl.sh/zh/glossary/common-name/): CN 即通用名称，是证书主体中曾用来填写域名的属性；现代浏览器已忽略它，只按 SAN 扩展匹配域名。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。