What is a SAN certificate?

A SAN certificate is one that lists its hostnames in the Subject Alternative Name extension. The name is slightly misleading, because every publicly trusted certificate today is a SAN certificate: browsers stopped reading hostnames from the older Common Name field years ago (Chrome dropped it in 2017), so the SAN list is the only thing that decides whether a certificate matches the site presenting it.

The extension holds a list of DNS names, and a single certificate can cover many of them: example.com and www.example.com at minimum, and often dozens of unrelated hostnames on shared hosting or CDNs. When a browser connects, it checks the hostname it dialled against that list. A certificate that is perfectly valid but lacks the name you used produces the same hard warning as an expired one, which is why "certificate is valid but the site shows an error" so often traces back to a missing SAN entry.

The operational failures are mundane and repeat everywhere. A certificate is renewed for example.com but the www entry is dropped from the request, and half the traffic breaks. A new subdomain launches on a certificate that never listed it. A load balancer serves the certificate of the wrong tenant, so the SAN list belongs to someone else entirely. None of these show up if your monitoring only asks "is the certificate expired?" — the question has to be "does the certificate served on this hostname actually contain this hostname?"

SAN lists also leak information: every name on the certificate is public, and Certificate Transparency logs make the full list searchable. Internal hostnames on a public certificate are an inventory of your infrastructure, published. Splitting certificates, or using a wildcard for internal names, keeps that list short.