What is a Common Name (CN) in an SSL Certificate?

The Common Name (CN) in an SSL/TLS certificate is a field that identifies the main domain name that this certificate belongs to. It is used mainly as the primary means for verifying the identity of the domain while conducting safe communication over the World Wide Web.

Originally, the CN field was necessary for client browsing applications and other clients to ensure that the server offering the certificate is linked to the domain name provided in the CN.

For instance, if the particular domain of a website is ‘example.com, then the SSL/TLS certificate for that domain will be CN=example. com.

Common Name Format

There is no additional format of CN in an SSL certificate, and it just contains the basic format, containing only the domain name, and there is no prefix.

For example, CN=example. Such information within the sting com would mean that the certificate will enable the establishment of secure communications for the region example.com.

The CN field has strict guidelines for the domain validation, as well as in most cases is expected to be the exact match of the domain for which it was issued to pass through the SSL/TLS handshakes.

Common Name (CN) for a Wildcard Certificate

CN is expressed in an asterisk (*) character followed immediately by a dot (.) followed by the bare domain. For example, CN= *.example.com.

With this format, it would appear that the wildcard certificate is applicable for the acquisition of communications for any subdomain of course.example.com, such as mail.example.com, www.example.com. 

The concepts of SAN and wildcard are related to each other because Wildcard certificates enable an organization to buy just one certificate for a domain and several of its subdomains helps to minimize the amount of management work and related expenses.

Difference between a Common Name (CN) and a Subject Alternative Name(SAN) in an SSL Certificate

Aspect	Common Name (CN)	Subject Alternative Name (SAN)
Definition	The Common Name (CN) in an SSL certificate has been used historically as an essential component towards defining the primary domain name where the certificate will be deployed to. This field is used to uniquely identify the certificate within the context of the original URL resource.	The Subject Alternative Name (SAN) or SAN extension or SAN field is an extension to an SSL certificate that permits the input of other domain names that the certificate has to cover. Thus, SAN is freedom from constraints of the CN field where certificates can contain details for multiple domains and services.
Purpose	CN applied to SSL/TLS encryption to validate the domain was historically the only field used for this purpose. It enhances the security of the certificate by making sure that the certificate is issued for the specific domain name as mentioned in the CN field.	SAN is used for expansion of SSL certificates as well as encompassing continuation in terms of multiple domain names and services. It enables administrators to use the certificate in gaining and securing more domains, subdomains, and may even extend to IPs making the applicability and value toward the certificate improved and costproductive.
Usage	Historically, the CN field was required for SSL certificates, and browsers use this field to check the domain name during the connection process.	SAN is slowly drawing its way into becoming the order of the day especially when securing multiple domains and subdomains under a single digital certificate. It gives the administrators more options regarding the administration as well as the protection of their networks.
Flexibility	CN is restricted to include only a single domain name within each certificate. The current version does not support multiple domain names or subdomains unless the program is to assign multiple certificates.	SAN offers considerable flexibility as it has the capability to include multiple domain names, sub domains and sometimes ips all under a single certificate. This reduces the burden of managing distinct certificates for other domains and services, as well as the overall costs of managing certificates.
Example	CN=example.com indicates that the SSL certificate is valid for securing communications for the domain example.com.	SAN=DNS .com, DNS .example.com, IP:192.0.2.1 specifies that the SSL certificate is valid for securing communications for example.com, www.example.com, and the IP address 192.0.2.1.
Compatibility	CN is supported by browsers and operating systems in domain validation during SSL/TLS connections.	While cooperating with multiple domains and subdomains, SAN is important in making services compatible with different browsers and devices. It increases the portability of the certificate for its use in other areas and systems and also its versatility.
Implementation	CN is required while generating traditional SSL certificates and the value must match the primary domain name of the Site for which the certificate is generated.	SAN is not mandatory but optional though important whereby it is necessary for certificates, especially those that are meant to cover several domains, sub-domains, or IPs. This is done through the CSR, in which additional names or entities are set in the SAN extension to be part of the certificate.

Conclusion

Be sure of your online reputation with Certera’s strong SSL certificates including single domain, Wildcard or SAN. It is critical to protect your website data, and this way, the audience will trust you.