Monitoring wildcard and SAN certificates

A single certificate can secure more than one name. A wildcard certificate covers every subdomain of a domain — anything under example.com — while a SAN certificate lists several specific names, its Subject Alternative Names, on one certificate. Both are common ways to secure a set of related hosts without issuing a certificate per name.

The convenience is also the risk. When one certificate covers many hostnames, one expiry or one bad renewal takes all of them down at once, and a re-issue that drops a name from the SAN list quietly breaks only the hosts that used it. A monitor that checks a single homepage will not notice that a subdomain or a name further down the list has stopped matching the certificate served there.

Monitoring wildcard and SAN certificates well means checking the actual names in play, not just the domain. A wildcard covers one level of subdomain, so a deeper name may not be protected the way people assume, and a SAN certificate is only as complete as its current list. Reading the certificate served at each hostname you care about — and confirming the name you asked for is actually on it — is what catches the gap before a visitor to that specific host does. With one certificate standing in for many names, that per-name check is what keeps a single renewal from quietly taking a whole set of subdomains offline at once.