X.509 Subject Alternative Name (SAN)
This extension to a certificate allows your server to be addressed by different names without validation errors
Why would I need more than one name?
If your site can be known by more than one name, for example, people type an unqualified host name in the intranet, then you will want to use Subject Alternative Name extensions to make their life more trustworthy.
For example, when I type into my browser: portal/ I get redirected to https://portal/
To my eyes this is correct. But to my browser this is indicative of a security breach: the certificate's CN (Common Name) is for portal.intranet.example.com.
The way to avoid this is to use a X.509 Subject Alternative Name (SAN) block.
Validation of Certificates
The underlying assumption when verifying the site you're visiting is that the certificate they present actually belongs to them. How do we know it belongs to them? Because it's their name on the certificate.
When there is more than one way to the certificate there needs to be more than one name on the certificate, (or you need to use Server Name Indication to hit the right destination).
Each certificate has a Subject which lists the name of the server it is issued to. Typically it will have some additional information, eg:
Subject: O=Happy Company / OU=Web Team / CN=portal.intranet.example.com
This last part, the CN, is the important part and it must match exactly what is in the browser window. portal is not the same as portal.intranet.example.com
Additional names
If you have additional names, then use a Subject Alternative Name (SAN) extension.
Beware: if you use a Subject Alternative Name then the Subject is ignored. Only the host names in the SAN are used.
This behaviour is codified in RFC 68xx, something or other. Look it up.
Your certificate now looks something like this:
Subject: O=Happy Company / OU=Web Team / CN=portal.intranet.example.com
Subject Alternative Name:
IP: 10.3.65.11
DNS: portal
DNS: portal.intranet.example.com
How do I generate a CSR with a SAN?
When you request a certificate from your friendly CA, and depending on their policies, simply include the SAN extension in your request. How? It's easy!
TODO: put an example openssl.cnf here. It's easy to edit.
Software support
It varies. All modern secure software supports it. There are still some Windows XP, Android 2, or OpenSSL 0.9.8e devices about, but they are a tiny minority. Unless you specifically need to support them, in which case they will fall back to use the Subject and ignore the SAN.
Are you interested in crypto?
Make your own client certificate.
Would you like to add ChaCha20 support to your website? Add ChaCha20 to your website!