Subject Alternative Names (SANs)

Modern browsers match the requested hostname against the leaf certificate’s Subject Alternative Name extension (DNS or IP entries). The legacy Common Name (CN) is a fallback in some tooling; TLSWatch checks SANs first and also considers CN.

What TLSWatch shows

• Parsed SAN list from the leaf
• A hostname mismatch flag when the requested host is not covered by SAN/CN (including simple left-most *.example.com wildcards)

Wildcard notes

A name like *.example.com covers www.example.com but not example.com itself and not deeper labels like a.b.example.com. TLSWatch applies that left-most-label rule for educational matching.

Inspect a hostname