(DC) Subject Alternative Name Field (SAN)
Description
The Subject Alternative Name field lets you specify additional host names (sites, IP addresses, common names, etc.) to be protected by a single SSL Certificate, such as a Multi-Domain (SAN) or Extend Validation Multi-Domain Certificate.
Subject Alternative Name (SAN) is an extension to the SSL Protocol; it allows various values to be associated with an SSL certificate using alternative names, for example:
Email addresses
IP addresses
DNS names or Common Name (FQDN)
Directory names or Distinguished Names
General Names or Universal Principal Names
Unless you need to have a SAN established for your certificate, it is recommended that you leave it blank. It is not necessary. The certificate authority might populate the SAN as part of the encoding process to included the host name or common name, but this is automatic and not required to be populated to have a certificate generated.
Valid SAN field entry prefixes
Not all certificates are SSL certificates, but just about all certificates support Subject Alternative Name (SAN). Thus, there are additional valid prefixes that exist that can put into a CSR, but are NOT valid for SSL certificates, such as LDAP entries, code signing, etc..
Prefix | Valid for Certificate Type | Description/Purpose |
|---|---|---|
|
| Provide additional FQDNs to the SSL Certificate that it will be validate. |
|
| Allows you to supply an IP address within the SAN list. This is very unorthodox, as it is literally impossible to validate an IP, but sometimes required by an application or service as a way of providing the IP that the FQDN should resolve to as a security measure. |
|
| Allows you to specify an email address in the SANs list. This is usually only required for the certificate to be used to sign email communications and verify the owner of the certificate and domain. Sometimes the application or service will send validation emails to the email address listed to ensure that the email is valid and can be responded to. |
|
| X.500 directory services were traditionally accessed via the X.500 Directory Access Protocol (DAP), which required the Open Systems Interconnection (OSI) protocol stack. LDAP was originally intended to be a lightweight alternative protocol for accessing X.500 directory services through the simpler (and now widespread) TCP/IP protocol stack.
|
|
| An OID corresponds to a node in the "OID tree" or hierarchy, which is formally defined using the ITU's OID standard, X.660. The root of the tree contains the following three arcs: Each node in the tree is represented by a series of integers separated by periods, corresponding to the path from the root through the series of ancestor nodes, to the node. Thus, an OID denoting Intel Corporation appears as follows, 1.3.6.1.4.1.343 and corresponds to the following path through the OID tree:
A textual representation of the OID paths is also commonly seen; for example,
Each node in the tree is controlled by an assigning authority, which may define child nodes under the node and delegate assigning authority for the child nodes. Continuing with the example, the node numbers under root node "1" are assigned by ISO; the nodes under "1.3.6" are assigned by the US Department of Defense; the nodes under "1.3.6.1.4.1" are assigned by IANA; the nodes under "1.3.6.1.4.1.343" are assigned by Intel Corporation, and so forth. |
There are so many more fields and support data that are not supported by SSL certificates. It is best to KISS (Keep It Small and Simple OR Keep it Simple, Stupid) and never put more information into a Certificate Signing Request than what is absolutely needed.
Troubleshooting
Alternative SAN Display
(invalid format, for display only)
There are defined standards on what a valid certificate signing request will entail and the proper values for the fields. Unfortunately, not all tools and services follow these standards.
For example, in Windows, it will display the SAN as: "DNS Name=aaa.bbb.ccc.edu"; which is an invalid format. It is best never to use these as templates for supplying information when creating a CSR; but know it is just a another way of representing existing data. Refer above, for valid field prefixes.
Non-Matching SAN Options
The SANs options you have entered do not match the SAN options on the original certificate.
This problem can occur for several reasons:
You added a space before or after the SAN.
There is a typo in the information you have provided.
You are entering the Common Name (CN) of the certificate as a SAN. Following regulations, we will always add your Common Name as a SAN, this does not need to be specified.
You incorrectly enter the SAN as a sub-domain, multi-domain name, internal SAN or IP. You need to choose the correct type of SAN which applies to the SAN. Please also check the above information on different SANs.