Search code examples
ssl-certificatepki

PKI SubjectAlternativeName number of entries specification


I would like to know how many different SubjectAlternativeNames a certificate may have and where this specification is published.

Why? Because FireFox only recognises the first five entries in the SubjectAlternativeName and we have a certificate that picks up a number of common misspellings of one of our websites, all of which have DNS entries pointing to the correct domain.

We do not wish to wildcard this certificate.


Solution

  • Are you sure that

    FireFox only recognises the first five entries in the SubjectAlternativeName

    because if you go to this page, it has many entries in SubjectAlternativeName and it works fine. Firefox does not complain even if the URL is not in the first five entries and when you click certificate details, it displays all of the entries correctly. I should mention that I'm using version 50.1.0 (but I have tested in version 49.0.2).

    Another example of a certificate with six entries can be found here (because previous one has wildcard entries first).