I have a very large cluster I am building of over 100 nodes, there are various types but I will use the Elasticsearch nodes as an example. I am encrypting mesh connections between nodes with TLS. For the smaller clusters this worked fine, but when generating a certificate for the larger cluster I ran into this issue:



Essentially the maximum size of the SAN list is 4096 bytes with 2/name for encoding, and my SAN list is already at 4566 bytes even without the encoding overhead.

So, my question is, if I split the SAN list into two certificates (signed by the same CA), is there any way to concatenate the two certs into one file that can be used for applications that require a single certificate file to be specified? Is it as easy as cat cert{1,2}.crt > combined.crt?

2 Answers 2


There is no way to combine multiple certificates into a single entity which then can be provided to the client for validation. It is also not possible to send multiple leaf certificates within the TLS handshake to the client in the hope that the client will pick the matching one.

The common way to deal with many names is instead to have many certificates and then use SNI to provide the expected one. This means that the client sends the expected domain inside the server_name extension within the TLS handshake ClientHello and the server will check this extension and provide the certificate which matches the requested name. Of course, this needs support by both client and servers. With HTTPS support for this is common in both clients and servers but for other TLS based protocols this might be different.

  • 3
    Another possibility if you name your machines systematically is (a cert with) a single wildcard name or a list of a few wildcard names. Dec 25, 2019 at 2:15

I think it's unsupported for cert that may be sent within the TLS handshake, and when I execute openssl x509 -in combined.crt -noout -text, only then first CERTIFICATE block display.

But if you concatenate multi CA certs to combined-ca.crt, and use it to verify cert, it's OK. for example, execute openssl verify -CAfile combined-ca.crt foobar.crt, it will return OK if one block of combined.crt can verify the foobar.crt

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .