How to check certificate SAN names using OpenSSL

TLS clients match a server certificate against the DNS name or IP address used for the connection. The Subject Alternative Name extension is the certificate field modern clients use for that identity, so checking it before deployment catches certificates that look familiar in the subject but do not cover the service name.

OpenSSL reads the local X.509 certificate file with the openssl x509 command. The focused -ext subjectAltName view prints the SAN list, while -checkhost and -checkip apply OpenSSL's matching rules to the certificate file.

Use the leaf server certificate for this check, not a private key, CSR, CA certificate, or unrelated chain member. A local file check proves what is inside that file; use a live TLS test when the question is which certificate a load balancer, proxy, CDN edge, or mail gateway is serving.

1. Open a terminal where the leaf certificate file is available as server.crt.

   Replace server.crt with the certificate being reviewed. For a binary DER certificate, add -inform DER to the openssl x509 commands.

2. Print only the Subject Alternative Name extension.

   $ openssl x509 -in server.crt -noout -ext subjectAltName
   X509v3 Subject Alternative Name: 
       DNS:server.example.com, DNS:www.example.com, IP Address:192.0.2.10

   Use DNS: entries for hostnames and IP Address: entries for literal IP addresses. A subject Common Name is not enough proof of modern TLS name coverage.

3. Check the required DNS name with -checkhost.

   $ openssl x509 -in server.crt -noout -checkhost www.example.com
   Hostname www.example.com does match certificate

   Use the DNS name clients put in URLs, SNI, API configs, or monitor checks.

4. Check the IP address only when clients connect to a literal address.

   $ openssl x509 -in server.crt -noout -checkip 192.0.2.10
   IP 192.0.2.10 does match certificate

   Do not treat a DNS SAN as IP coverage. Literal IP connections need an IP SAN entry.

5. Check every required alternate hostname before approving the certificate.

   $ openssl x509 -in server.crt -noout -checkhost api.example.com
   Hostname api.example.com does NOT match certificate

   This output means the certificate file does not cover api.example.com. Reissue the certificate with that SAN entry before installing it for that name.

6. Treat a certificate with no Subject Alternative Name extension as unapproved for server-name coverage.

   $ openssl x509 -in legacy.crt -noout -ext subjectAltName
   No extensions in certificate

   No SAN extension should stop normal server hostname approval even when the subject contains a familiar CN value.