Invalid Common Name when using a SAN certificate

Question

I have generated a certificate for an internal server that is also accessible externally. According to this SO answer the CN and the SAN fields compliment each other and so accordingly I set the CN to server.domain.local and in the SAN I have DNS:server.domain.tld

However, with Chrome at least, I can browse to server.domain.tld (SAN entry) without error but I get a common name mismatch error at server.domain.local (CN)

Is this an implementation error in NSS on Chrome or have I done something wrong? Should I have both server.domain.local and server.domain.tld in the SAN field?

Answer 1

the CN and the SAN fields compliment each other and so accordingly I set the CN to server.domain.local and in the SAN I have DNS:server.domain.tld

No (but that post is kind of old now).

Placing a DNS name is the Common Name (CN) is deprecated by both the IETF and CA/Browser Forums. You should place all DNS names in the Subject Alternate Name (SAN). Use the CN for a friendly name like "Example LLP" since its displayed to the user.

According to the CA/Browser Baseline Requirements (BR), a DNS name in the CN must also be present in the SAN. See CA/B BR, Section 9.2.

---

Chrome at least, I can browse to server.domain.tld (SAN entry) without error but I get a common name mismatch error at server.domain.local (CN)

Chrome is correctly rejecting the certificate if server.domain.local is present in the CN, but is not present in the SAN. Its a violation of the CA/B BR if its not present in both.

---

Should I have both server.domain.local and server.domain.tld in the SAN field

Yes, place both DNS names in the SAN. Don't put a DNS name in the CN. Use the CN for a friendly name.

---

For completeness, CA/B stands for CAs and Browsers. They have their own little closed club, and they have their own set of policies for issuing certificates. Don't expect browsers to do things as specified in the IETF docs.

And if you are validating X509 certificates used in the wild issued by a CA that is a member of CA/B, then you should validate using the CA/B BR, and not the IETF docs.