Browser tool
Hostname matcher
Paste a certificate (or type its names), type the host name you connect to, and see which entry matches and why the others do not. Nothing leaves your browser.
How to use it
- Paste the server's certificate, or switch to typing the names as OpenSSL prints them (DNS:www.example.com, IP Address:192.0.2.1).
- Type the host name or IP address from your URL. A whole URL works too.
- Read the verdict and the table: every name in the certificate, whether it matches, and why.
Questions
Does *.example.com cover example.com?
No. A wildcard stands for exactly one label: it covers www.example.com, but not example.com and not a.b.example.com. Put example.com in the SAN as its own entry.
Do clients still use the Common Name?
Browsers and Go do not. Some libraries (OpenSSL's host-name check, curl, Python and Node.js) still fall back to the Common Name when the SAN holds no DNS name: no SAN at all, or only IP addresses. Once the SAN lists a DNS name, every client ignores the CN.
Can a certificate cover an IP address?
Yes, with an IP Address entry in the SAN. A DNS entry that contains the address as text does not count.