I have a certificate with a common name of "myApi.mycompany.com" and 3 SANs: "myApi-dev.mycompany.com", "myApi-uat.mycompany.com" and "myApi-stg.mycompany.com".

The problem is that when I try to use the common name "myApi.mycompany.com" it says that the certificate is only valid for the SANs? is that a bug or that's by design?

1 Answer 1


is that a bug or that's by design?

it is by design. RFC 2818 §3.1 says:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity

That is, all names you use for this certificate MUST be included in SAN extension.

BTW, that RFC is 22 years old now.

  • 1
    Although 2818 only applies to HTTPS, which OP didn't say. Other TLS-based protocols mostly followed suit, and 6125 (in 2011) effectively required it for everything subsequent. Apr 15, 2022 at 0:01
  • SAN examples and observed behavior suggests that it's HTTPS. Anyway, thanks for correction.
    – Crypt32
    Apr 15, 2022 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .