A SAN certificate is an SSL/TLS certificate that lists multiple hostnames or IP addresses in its Subject Alternative Name (SAN) extension, allowing one certificate to protect many different domains or subdomains. Modern TLS certificates are required to include the SAN extension; the term "SAN certificate" typically refers to one listing more than one name.
Every certificate issued today must include at least one entry in the SAN extension—this is the authoritative field for hostname verification during the TLS Handshake. The Common Name (CN) field in the certificate subject is now deprecated for identity verification. The SAN extension can contain:
- Multiple DNS names (e.g.,
example.com,www.example.com,mail.example.com) - IP addresses (IPv4 or IPv6)
- Email addresses
- Uniform Resource Identifiers
This approach is far more flexible than issuing separate certificates for each domain. A single SAN certificate can protect 2 to 250+ names depending on the Certificate Authority and certificate tier.
Common use cases:
- Securing an API and its multiple subdomains
- Protecting multiple closely related sites under one cert
- Securing load-balanced services where multiple hostnames resolve to the same endpoint
SAN certificates can be combined with wildcard certificates (e.g., *.example.com) to reduce the number of unique names needed. Certificate Authorities like Let's Encrypt issue SAN certificates via the ACME Protocol.
TipAll modern SSL certificates use SAN; the feature is not optional or a premium upgrade—it's the standard. Single-domain and wildcard certificates are just SANs with one entry.