What Is a Subject Alternative Name in TLS?

A subject alternative name, usually called a SAN, is an extension in a TLS certificate that lists the hostnames or other identities the certificate is valid for. In modern TLS validation, the SAN list is the key place clients look when deciding whether a certificate matches a hostname.

That means a single certificate can cover multiple DNS names such as example.com, www.example.com, and api.example.com.

• They define which hostnames the certificate can legitimately secure
• They help browsers and clients validate hostname identity
• They make it possible to issue multi-domain certificates
• They provide useful discovery clues during audits and asset inventory work

When a TLS warning says the certificate does not match the hostname, the first thing to inspect is the SAN list. If the requested hostname is not present, the problem may be a misissued certificate, the wrong endpoint, or traffic being routed to an unexpected service.

SAN inspection is also useful when trying to understand what other names a platform, CDN, or shared certificate may be serving.

A SAN entry does not prove the hostname is currently live, controlled, or intentionally public. It only proves the name appeared in that certificate. Like CT data, SAN data should be treated as an investigative clue rather than as final proof of exposure.

It is also common for certificates to contain hostnames used for operational convenience rather than for actively exposed production services.

That is why SAN analysis works best when paired with DNS and service validation. The certificate can show you what names were intended, but additional checks are what tell you whether those names still matter today.

• Investigating a certificate mismatch or TLS error
• Discovering related hostnames on a public endpoint
• Reviewing third-party or hosted-service exposure
• Supporting subdomain inventory and attack-surface analysis
• Confirming whether a service certificate covers the intended names

Because SANs are tied to live certificates, they are often one of the fastest ways to understand what identities a public endpoint is prepared to present, even before deeper application analysis begins.

• Certificate SAN Explorer
• How Certificate Transparency Helps Find Subdomains
• Subdomain Finder