Multi-Domain (SAN) Certificates
How Subject Alternative Names Work
A SAN certificate is a certificate whose Subject Alternative Name field lists several host names, so one certificate can secure many different domains. The name comes from the standard extension that holds these alternative names, which is where browsers look for the names a certificate covers.
Each entry in the list is a separate name, and the names do not need a common parent. One certificate can cover example.com, example.org and example-shop.net, provided the certificate authority has validated control of each one. When a browser connects, it compares the host name in the address bar with this list.
Older certificates also had a single common name field. Modern browsers ignore it for host name checks and rely on the SAN list, so every name that should be protected must appear there.
Where Multi-Domain Certificates Are Used
The most common use is a server or platform that hosts several sites with different domain names. Rather than installing a certificate for each site, the operator requests one that lists them all. This keeps administration simpler and leaves fewer files to renew.
Mail, collaboration and hosting control panels often use this model. Microsoft Exchange environments, for example, have long used multi-domain certificates, sometimes called Unified Communications Certificates, to cover mail and autodiscover names across several domains.
Because one certificate serves every name, clients that do not send Server Name Indication still receive a certificate that covers their domain.
Limits and Trade-offs
A SAN certificate covers only the names on its list. A new subdomain such as blog.example.com is not protected until it is added and the certificate is reissued. This takes more work than a wildcard, but each name is a deliberate choice.
Lists can grow large, and certificate authorities and software impose practical limits on how many names one certificate can carry. For many subdomains of one domain, a wildcard certificate may be simpler. Unrelated domains also share one private key, so a key compromise affects every site on the list. Teams often group names by owner or risk level for this reason.
Example: Three Client Sites on One Server
A small agency hosts three client websites on one server: clientone.com, clienttwo.net and clientthree.org. Each site has its own domain, and all three share one IP address. A single SAN certificate that lists all three names is presented to every visitor, and each visitor's browser accepts it because its own domain appears on the list. When a client leaves, the agency must reissue the certificate without that name.
Frequently asked questions
Can one SAN certificate cover unrelated domains?
Yes. A SAN certificate can list domains that have nothing in common, such as example.com and example.org, provided the certificate authority validates control of each one. This is the main difference from a wildcard, which covers only subdomains of one parent domain.
Is a SAN certificate the same as a wildcard certificate?
No. A SAN certificate lists specific names, which can be unrelated. A wildcard covers every first-level subdomain of one domain. Many setups combine the two, and a side-by-side comparison appears in wildcard vs SAN certificates.