Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A SAN (Subject Alternative Name) certificate is an X.509 certificate whose subjectAltName extension lists the identities the certificate is allowed to represent. One certificate can therefore cover several DNS names, IP addresses, email addresses or URIs. To create one with OpenSSL, define those names in a configuration file, generate a private key and CSR, have a trusted CA issue the certificate (or self-sign it for a private test), then inspect the issued certificate to confirm every required SAN is present.
What a SAN certificate contains
SAN is short for Subject Alternative Name. In RFC 5280, subjectAltName is a sequence of GeneralName values. Each value has a type, and the type determines how a client interprets the identity.
| Identity | OpenSSL configuration form | Example |
|---|---|---|
| DNS hostname | DNS.n |
DNS.1 = example.com |
| IP address | IP.n |
IP.1 = 192.0.2.10 |
| Email address | email.n |
email.1 = admin@example.com |
| URI | URI.n |
URI.1 = spiffe://example.org/service |
| Registered object identifier | RID.n |
Assigned object identifier value |
| Directory name or other name | dirName.n or otherName.n |
Values defined by the corresponding directory or application profile |
Use the matching type, not merely a value that looks similar. An IP literal placed in DNS.1 is a DNS name, not an IP SAN, and can fail hostname or address validation. URI values must contain a scheme and scheme-specific part; empty GeneralName values are not valid.
Why the common name is not enough
The Common Name (CN) in the subject is useful descriptive information, but clients that validate modern certificates look to SAN entries for the identities they connect to. Put every hostname or address that clients will actually use in the SAN extension, even when one of them is also copied into the CN.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
One certificate, several names
A certificate can combine types, such as DNS.1 = app.example.com, DNS.2 = api.example.com and IP.1 = 192.0.2.10. A CA still decides which identities it will issue after its validation process. Wildcards are DNS names only and remain subject to the issuing CA’s policy; they do not automatically cover an IP address.
Choose the trust model before generating anything
| Use case | How the certificate is produced | What clients must trust |
|---|---|---|
| Public website or public API | Submit a CSR to a publicly trusted CA, often through an automated ACME workflow or a manual CA process. | The public CA chain must be trusted by the browser, operating system or client. |
| Enterprise service | Submit the CSR to an enterprise or third-party CA following its identity-validation rules. | The enterprise or third-party root and intermediates must be installed or otherwise trusted by clients. |
| Lab or private test | Create a self-signed certificate with OpenSSL, or issue from a private test CA. | Every test client must explicitly trust the self-signed certificate or private CA. |
A self-signed certificate is not automatically trusted by public browsers or operating systems. Self-signing is appropriate for a controlled lab, while production public trust requires an appropriate CA chain.
Create the SAN configuration file
Create a file named san.cnf. The [alt_names] section is where you enumerate identities. Number entries consecutively for each type.
[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C = US
ST = State
L = City
O = Example Organization
CN = example.com
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
IP.1 = 192.0.2.10Replace the subject fields and SAN values with identities you control and intend to use. Add further entries as needed:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDNS.3 = api.example.com
IP.2 = 2001:db8::10
email.1 = admin@example.com
URI.1 = spiffe://example.org/serviceDo not place a port number in a DNS SAN. A client connecting to https://example.com:8443 still validates the hostname example.com; the port is not part of the SAN.
Generate the private key and CSR
- Protect the working directory. Keep the key and CSR in a directory accessible only to the account that needs them. The private key is the credential corresponding to the CSR’s public key.
- Run OpenSSL:
openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr -config san.cnf -reqexts req_ext-newkey rsa:2048creates a new RSA key and-newcreates a CSR.-nodesleaves the private key unencrypted so a service can start without an interactive passphrase; omit it when you want an encrypted key and can provide passphrase handling at service start. - Inspect the CSR before submission:
openssl req -in example.csr -text -nooutLook for a Requested Extensions section containing
X509v3 Subject Alternative Nameand the expected entries. - Submit the CSR. Send
example.csrto your enterprise, private or public CA according to that CA’s validation process. Never sendexample.key.
What the CSR does and does not guarantee
A CSR expresses requested extensions, including SANs. It does not force the CA to copy those extensions into the final certificate. The issuing CA controls the certificate contents, validity period, key-usage decisions and trust chain. Always inspect the certificate you receive instead of assuming the CSR was honored.
Self-sign a certificate for private testing
For a lab, you can create a self-signed certificate directly from the same configuration:
openssl req -x509 -newkey rsa:2048 -nodes
-keyout example.key
-out example-cert.pem
-days 365
-config san.cnf
-extensions req_extThe -x509 option makes openssl req output a certificate instead of a CSR. The -days 365 value is the requested validity period for this test certificate; production CA policies may impose different limits. Install the resulting certificate, or preferably a private CA certificate that issued it, in the trust store of each test client. Do not use this certificate as if it had public trust.
Rank #3
Verify the issued certificate and SANs
After the CA returns a certificate, save it as issued-cert.pem and inspect both the full text and the key identity fields:
openssl x509 -in issued-cert.pem -text -noout
openssl x509 -in issued-cert.pem -noout -subject -issuer -datesIn the full output, find X509v3 Subject Alternative Name. Check every hostname and IP address clients will use, and check that each appears under the correct type. Also compare:
Recommended Free Tools
- Subject: the certificate’s subject fields, including the descriptive CN.
- Issuer: the CA that signed the certificate.
- Validity: the
Not BeforeandNot Afterdates. - Extensions: SAN, key usage, extended key usage and any constraints required by your application.
If a requested SAN is missing, contact the CA or regenerate and resubmit the CSR with the corrected configuration. Editing the CSR after signing cannot change an already issued certificate.
Common SAN mistakes and fixes
An IP address was entered as DNS
Symptom: a client connecting by address reports a name mismatch even though the certificate appears to contain the address. Fix: use IP.n = 192.0.2.10 (or an IPv6 value), not DNS.n. The GeneralName encoding is different.
A real hostname was omitted
Symptom: www.example.com works but example.com, an API subdomain or an internal alias fails. Fix: list every exact DNS name used by clients. A certificate for one hostname does not automatically cover another; a wildcard only covers names allowed by its wildcard pattern and CA policy.
Rank #4
The CSR has SANs but the certificate does not
Symptom: openssl req -text shows the requested SAN, while openssl x509 -text does not. Fix: the CA did not copy or approve the requested extension. Review the CA request fields and its issuance profile, then obtain a new certificate.
The certificate is reported as untrusted
Symptom: the SAN matches, but browsers or clients still reject the connection. Fix: install the correct private root and intermediate certificates for a private or enterprise CA, or configure the server to send the public CA’s intermediate chain. A matching SAN does not establish trust by itself.
The certificate is expired or not yet valid
Symptom: date validation fails despite correct names. Fix: inspect -dates, check the client clock, and renew before the Not After date. Replace the deployed certificate and reload the service according to its documentation.
The key and certificate do not match
Symptom: the server refuses to start or reports a private-key mismatch. Fix: use the key that created the CSR and verify that deployment did not mix files from separate requests. Keep a clear filename and change record for each issuance.
Operational practices for reliable SAN certificates
- Maintain a single inventory of production hostnames, IPs and service URIs, including less obvious aliases used by health checks and automation.
- Use a repeatable configuration template, but review the actual SAN list for each service before generating a CSR.
- Protect private keys with filesystem permissions, secret-management controls and backups that do not expose the key unnecessarily.
- Test the certificate from the same DNS names and addresses that real clients use. Testing only the CN or one SAN can miss an omitted identity.
- Automate renewal where your CA supports it, and monitor expiry dates so deployment occurs before expiration.
- After every renewal, inspect the new certificate; a successful CA transaction does not prove that the intended SAN set was issued.
Or skip the browser setup
If your documentation or monitoring work also needs clean website screenshots, ScreenshotNeo returns a PNG, JPEG, WebP or PDF from one request. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and the response identifies the page verdict and billing status in headers.
Use the API examples in the ScreenshotNeo documentation (replace the target URL with the page you need):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots, and every feature is available on every plan. Sign up free for ScreenshotNeo.
Frequently Asked Questions
Can one SAN certificate contain both DNS names and IP addresses?
Yes. Add DNS identities with DNS.n and address identities with IP.n in the same subjectAltName extension. Clients still validate each identity according to its type.
Should I include the server’s IP address if users normally connect by hostname?
Only if a client will actually connect by that address or an application profile requires it. Include every real connection identity, but avoid adding unused names that complicate inventory and renewal.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can I change SANs without generating a new certificate?
No. SAN is part of the signed certificate. Create a new CSR and obtain a replacement certificate whenever the required identity set changes.
The Bottom Line
A SAN certificate is an X.509 certificate whose typed Subject Alternative Name entries define the DNS names, IP addresses, email addresses or URIs it can represent. With OpenSSL, define those entries, generate and protect the key, submit the CSR to the right CA, and verify the issued certificate rather than trusting the request alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
