For quite a while, it has been common that the CN of a web server certificate also needs to be present in the SAN list, and new versions of browsers enforce this. So, if my CN is
www.example.com, and the SAN has only
example.com, browsers will refuse to connect, resp. show certificate warnings and have the user take extra steps (just like with expired certificates etc.).
What's the reason for this, and specifically, does it have any security advantages? After all, including or omitting
www.example.com in/from the SAN doesn't make the certificate any harder to get.
- While "just check the SAN list" may be a bit easier to implement than "check the SAN, and fall back to CN if the host name isn't found", it doesn't make much of a difference, and browsers have been doing that for years anyway.
- In cases of shared hosters that have many domains on the same host, I could imagine a certificate having a CN of
shared-host-5238.example-hoster.comand a SAN of
www.example.com; a browser wouldn't connect to
shared-host-5238because that isn't included in the SAN. But that protects the server more than the client (the client would actively need to seek out the shared-host URL), and you could send requests to the
shared-hostURL anyway, ignoring certificate errors, so there's not much protection for the host either.
- Is it to open up the possibility of having the CN not include the domain name at all, to free it up for organization name/location/whatever? There seems little point in this because certificates have other fields for that.
So, what is a scenario where requiring the CN being duplicated in the SAN improves security?