Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are the CN and SAN fields in a certificate?
Short answer
CN (Common Name) is the main name in the subject information of the certificate; SAN (Subject Alternative Name) is the list of all the domains (and, if needed, the IP addresses) for which the certificate is valid. Current browsers and clients perform domain matching only through the SAN; a name that is not in the SAN list is considered invalid even if it is written in the CN. In TR7, in a certificate issued with Internal CA, the Common Name (CN) is always added to the SAN list as well; in a CSR, the names are written in the Subject Alternative Names field, and the names of an installed certificate appear in the CN and DNS rows in the Details tab of its preview.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Certificates & PKI → SSL/TLS Certificates → Add → Internal CA | Common Name (CN), Alternative Names (SAN) | The names of the certificate to be issued with Internal CA; the CN is always added to the SAN list |
| SSL/TLS Certificates → CSR (External CA) → Add | Common Name (CN), Subject Alternative Names | The names to be signed by the CA |
| Certificates & PKI → Certificate Profiles | SAN Template | The template to be used if Alternative Names (SAN) is left empty (with the {cn} placeholder) |
| Certificates & PKI → Client Certificates | Person or Device (CN), E-mail Addresses, Windows Logon Names (UPN) | The identity in the client certificate; the e-mail and the UPN are written into the SAN |
| SSL/TLS Certificates → preview → Details | CN, DNS | The CN value of the installed certificate and the domains in the SAN |
| Backend Service → Certificate verification = Required | SNI | If SNI is set, the name in the Backend Service certificate is compared with this value |
Common Misconceptions
- "The name written in the CN is enough." Clients look at the SAN (RFC 9525); the domain must be in the SAN list.
- "A separate certificate is required for every domain." Multiple domains can be added to the SAN list of a single certificate; a wildcard name can also be used for all the subdomains at a single level (What is a wildcard certificate?).
- "The CN is added to the SAN in client certificates too." TR7 does this only in server certificates; the SAN list of a client certificate carries the e-mail addresses and the Windows logon names.
How it is done in the documentation
