X.509 certificates as of RFC5280 offer the two fields "Subject" and "Subject Alternative Name" that can be used to describe the Subject of the certificate (e.g. a Domain example.com). Section 220.127.116.11 of RFC5280 reads:
The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI). […] Whenever such identities are to be bound into a certificate, the subject alternative name (or issuer alternative name) extension MUST be used; however, a DNS name MAY also be represented in the subject field […]
My understanding is that in all X.509 conforming certificates the contents of the subject field must also be included in the "SubjectAlternativeName" field.
In which case is it necessary to check the "Subject" field of a certificate?
Do I, for compatibility reasons, need to check the "Subject" field? Do (non-conforming) X.509 certificates exist in the wild that don't use the "SubjectAlternativeName" field?
I'm interested in this question in general, but if you have specific knowledge about how this is commonly handled in wifi security (e.g. PEAP), please include it in your answer.