Subject Alternative Name

Overview#

Subject Alternative Name (OID 2.5.29.17) (subjectAltName or SAN) attribute is an Certificate Extensions to X.509 that allows additional Certificate Subject names to be associated with certificate.[1] If the Certificate Authority issues certificates with an empty sequence for the Certificate Subject, the CA MUST support the Subject Alternative Name Certificate Extension

Subject Alternative Name MAY include:

Subject Alternative Name and IP Address#

RFC 5280 section 4.2.1.6 specifies iPAddress alternative name format, designed to hold dotted quads (IPv4) or 16 octets (IPv6).

Browser/client compatibility will vary.

You can specify a dotted quad in a dNSName field of the SAN. To quote RFC 5280:
The name MUST be in the "preferred name syntax", as specified by Section 3.5 of RFC 1034 and as modified by Section 2.1 of RFC 1123 The latter suggests that software should be tolerant of finding IP addresses in "host name" fields:

Whenever a user inputs the identity of an Internet host, it SHOULD be possible to enter either

The host SHOULD check the string syntactically for a dotted-decimal number before looking it up in the Domain Name System.

Please note also that, per RFC 5280: Because the dNSName is considered to be definitively bound to the Public Key, all parts of the Subject Alternative Name MUST be verified by the CA.

When we last checked, the following IGNORED IP Address and expect the value as string in dNSName:

but: do not expect an IP Address as dNSName but need it as iPAddress.

More Information#

There might be more information for this subject on one of the following:
Please see our Copyright And Intellectual Property Page and Standard Disclaimer Pages!