What is the SSL Certificate Common Name?
Last updated
Table of Contents
The Common Name (also called CN) is a field in SSL certificates that names the primary server the certificate protects. Browsers no longer use it to decide whether a certificate matches a site: they check the hostname against the certificate’s Subject Alternative Name (SAN), which must also include the common name. If the hostname is not listed, the browser shows a host name mismatch error.
In the case of a single-name certificate, the common name consists of a single host name (e.g. example.com, www.example.com), or a wildcard name in case of a wildcard SSL certificate (e.g. *.example.com).
The common name is technically represented by the commonName field in the X.509 certificate specification. When you order a Sectigo SSL certificate, the name you enter becomes the common name, and a custom CSR carries it in its subject.
commonName format
The common name is not a URL. It does not include any protocol (e.g. http:// or https://), port number, or pathname. For instance, https://example.com or example.com/path are incorrect. In both cases, the common name should be example.com.
It must precisely match the server name where the certificate is installed. If the certificate is issued for a subdomain, it should be the full subdomain. For instance, for the www and api subdomains of example.com, the common name will be www.example.com or api.example.com, and not example.com.
Single-name or Wildcard?
Read How to Choose SSL Certificate Names for help determining the appropriate host names for your certificate.
Example of host name mismatch error on Google Chrome
Example of host name mismatch error on Safari
Common Name vs Subject Alternative Name
The common name can only contain up to one entry: either a wildcard or non-wildcard name. It is not possible to specify a list of names covered by an SSL certificate in the common name field.
The Subject Alternative Name extension (also called Subject Alternate Name or SAN) was introduced to solve this limitation. The SAN allows issuance of multi-name SSL certificates.
The ability to directly specify the content of a certificate SAN depends on the Certificate Authority and the specific product. At DNSimple, Let’s Encrypt certificates can list several names, while Sectigo certificates cover one name or a wildcard. See SSL Certificate Types for the options. Most certificate authorities have historically marketed multi-domain SSL certificates as a separate product. They are generally charged at a higher rate than a single-name certificate.
On the technical side, the SAN extension was introduced to integrate the common name. Since 2000, when RFC 2818 described HTTP over TLS, the use of the commonName field for hostname matching has been considered deprecated, because it is ambiguous and untyped.
The CA/Browser Forum has since required that the SAN also include any value present in the common name, making the SAN the only reference a client needs to match a certificate to the server name. Chrome stopped using the common name for hostname matching in Chrome 58, released in 2017, and checks only the SAN. The common name survives mostly as a legacy field.
Have more questions?
If you have additional questions or need any assistance with common names and how they relate to SANs, just contact support, and we’ll be happy to help.