Search code examples
ssl-certificatex509

Maximum number of SAN (subject alternative names) allowed

Is there any limit for subject alternative names in X.509? Also are there any rules for the SAN?

Solution

  • 1. Also are there any rules for the SAN?

    RFC5280 specifies Subject Alternative Names as

    SubjectAltName ::= GeneralNames

    whereby GeneralNames are

    GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName

    So, look the up the 'rules' for a GeneralName in the rfc (page 37).

    2. Is there any limit for subject alternative names in X.509?

    As stated in the same rfc in chapter Appendix B. ASN.1 Notes:

    The SIZE (1..MAX) construct constrains the sequence to have at least
one entry.  MAX indicates that the upper bound is unspecified