Skip to main content

Hostname Findings

A certificate lists the names it covers in its Subject Alternative Names (SANs), and in older certificates also its Common Name (CN). The check compares them with the monitor's hostname.

For HTTPS monitors the hostname must be one of the SANs, and the Common Name is ignored, as browsers do. Other protocols (mail, FTP, LDAP, databases, SIP) have clients that still accept the Common Name, so a certificate with the hostname only in its CN matches there, with a suggestion to reissue it.

To confirm any fix on this page, click Check Now on the monitor's page. openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -ext subjectAltName lists the names the served certificate covers.

CERT_HST01: Hostname only in the Common Name​

Key: CERT_HST01 · Label: Matched CN, No SAN · Severity: Notice (a suggestion) · Can be dismissed: Yes

What it means: the hostname matches only the certificate's Common Name; it isn't one of its Subject Alternative Names.

Why it matters: browsers check only the SANs, and more clients are following. A certificate without a SAN for the hostname will stop being accepted as clients update.

How to fix it: reissue the certificate with this hostname as a Subject Alternative Name. Every public CA adds the SAN automatically; this usually comes from a certificate made by hand or by an internal CA.

CERT_HST02: Certificate doesn't cover this hostname​

Key: CERT_HST02 · Label: Name Does Not Match · Severity: Error · Can be dismissed: No

What it means: the certificate's names (its Subject Alternative Names, and its Common Name for protocols other than HTTPS) don't include this hostname.

Why it matters: clients reject the connection, or show a warning that the site isn't who it claims to be.

How to fix it: install a certificate that covers this hostname. If the server has the right certificate but serves another one, check that it picks the certificate by the requested name (SNI): a server with several sites sends its default certificate to a name it doesn't recognize. A wildcard such as *.example.com covers www.example.com but not example.com or a.b.example.com.