# What Is Subject Alternative Name (SAN)? Definition and Examples

> Subject Alternative Name (SAN) is the X.509 extension listing the DNS names, IP addresses or other identities a certificate is valid for.

Source: https://ssl.sh/glossary/san/
Last updated: 2026-11-10

The SAN extension, defined in RFC 5280, holds a list of typed names: `dNSName` for hostnames, `iPAddress` for IPv4 or IPv6 addresses, `rfc822Name` for email addresses (used by S/MIME) and `uniformResourceIdentifier` for URIs. TLS clients compare the hostname they connected to with the DNS or IP entries; the [Common Name](https://ssl.sh/glossary/common-name/) is no longer consulted. A single certificate may carry many SAN entries, which is what makes [multi-domain certificates](https://ssl.sh/glossary/multi-domain-certificate/) possible.

## Why it matters
If a name is not in the SAN, the certificate is not valid for it. [Wildcard](https://ssl.sh/glossary/wildcard-certificate/) entries such as `*.example.com` match exactly one label: `www.example.com`, but neither `example.com` nor `a.b.example.com`. That is why most certificates list `example.com` together with `www.example.com` or `*.example.com`. Every SAN entry must be validated by the CA, and the list is fixed at issuance; adding a name means getting a new certificate.

## Example
Create a key and a CSR with two SAN entries:

```bash
openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
```

The `-addext` option requires OpenSSL 1.1.1 or later.

## Common misconceptions
- **`*.example.com` also covers `example.com`.** It does not; the bare domain needs its own entry.
- **SAN entries can be added to an existing certificate.** Any change would break the CA's signature; you must request a new certificate.
- **A "SAN certificate" is a special product.** Nearly every TLS certificate has a SAN extension; the marketing term just means one with several names.

## Related terms

- [CN](https://ssl.sh/zh/glossary/common-name/): CN 即通用名称，是证书主体中曾用来填写域名的属性；现代浏览器已忽略它，只按 SAN 扩展匹配域名。
- [多域名证书](https://ssl.sh/zh/glossary/multi-domain-certificate/): 多域名证书是在 SAN 扩展中列出多个不同主机名、让一张证书同时保护多个域名的 TLS 证书。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [IP 证书](https://ssl.sh/zh/glossary/ip-address-certificate/): IP 证书是在 SAN 中写入 IP 地址的 TLS 证书，使客户端在直接通过 IP 访问服务器时也能验证其身份。
- [CSR](https://ssl.sh/zh/glossary/csr/): CSR 是证书签名请求，包含申请者的公钥和希望写入证书的身份信息，用私钥签名后提交给 CA 以申请证书。