SAN certificate

A SAN certificate lists every hostname it covers in its Subject Alternative Name field. Modern certificates all do this, so the phrase mostly means "a certificate covering more than one name".

The older Common Name field is dead for this purpose. Browsers stopped using it for name matching years ago, and a certificate whose name appears only in the Common Name fails validation in every current browser. If you generate certificates yourself, put every name in the SAN list.

A wildcard entry such as *.example.com matches one level only. a.example.com matches, a.b.example.com does not, and the apex example.com needs its own entry.

What Domduck records

Every SAN on the certificate, stored with the daily certificate reading.

They are worth keeping because the list changes for reasons nobody announces. A name appearing means a new site joined the deployment. A name disappearing means the opposite, and it usually happens during a migration where somebody rebuilt the certificate from a shorter list.

Why it matters

The most common certificate outage is a name that is not on the list. Everything about the certificate is valid, the expiry is months away, and one hostname fails because the renewal dropped it.

A SAN list is also public. Anything you put on a shared certificate is advertised to anyone who connects, including internal hostnames. If a name would embarrass you in a log, give it its own certificate.