Is it ok to specify subdomains in certificates that support SAN.
For example base domain is
example.com and I want
c.example.com to be included? What is the primary purpose of SANs?
The purpose of SAN is to specify all host names for which a certificate can be used. This also includes any subdomains a certificate should be valid for, i.e. a certificate for
example.com will not be automatically valid for
foo.example.com but this subdomain must be explicitly specified as valid. Entries can also be wildcards. A proper implementation will no longer look at the common name at all if DNS names are given in the SAN section.