stackoverflow.com and found in Chrome that its certificate is valid and has
Common Name (CN) *.stackexchange.com. After that I checked a fingerprint for
stackexchange.com and it matched the first one. I thought that Chrome would show me a warning that the domain didn't match, as
stackoverflow.com doesn't redirect to
stackexchange.com and it doesn't have a CNAME to it -
dig +short stackoverflow.com cname - shows nothing. My question is: how does Chrome recognise that
stackoverflow.com is part of
A certificate Common Name is not the only thing used to validate a certificate. It is actually only used for very primitive certificates that lack a subjectAltName extension.
The StackOverflow certificate has got a subjectAltName field with the following dNSNames in it, which allow the certificate to validate for StackOverflow.
Originally certificates were only valid for a single name. But with the growth of the web, it was very common that the same server would be accessible under multiple names. So certificates were extended to permit multiple names. The use of the Common Name (CN) field has been deprecated since 2000 in favor of the subjectAltName field (Subject Alternative Name, often abbreviated SAN). The subjectAltName field can contain a list of names (or name patterns starting with a wildcard), not just a single name.
The subjectAltName field for the certificate offered by
stackoverflow.com as well as
*.meta.stackexchange.com, etc. Chrome recognizes
stackoverflow.com in the subjectAltName field. It's a bit weird that it only shows the CN value in the overview, but you can view the certificate details and see the SAN entries under “*.stackexchange.com” → “Certificate” → “Extensions” → “Certificate Subject Alternative Name”.