> Test whether a host name matches a certificate: SAN entries, one-label wildcards, IP addresses and the Common Name, explained with the rules of RFC 9525. Source: https://pkizerotohero.com/tools/hostname/ Browser tool # Hostname matcher Paste a certificate (or type its names), type the host name you connect to, and see which entry matches and why the others do not. Nothing leaves your browser. *Interactive tool: Hostname matcher (runs in the browser at [/tools/](https://pkizerotohero.com/tools/))* ## How to use it 1. Paste the server's certificate, or switch to typing the names as OpenSSL prints them (DNS:www.example.com, IP Address:192.0.2.1). 2. Type the host name or IP address from your URL. A whole URL works too. 3. Read the verdict and the table: every name in the certificate, whether it matches, and why. ## Questions Does \*.example.com cover example.com? No. A wildcard stands for exactly one label: it covers www.example.com, but not example.com and not a.b.example.com. Put example.com in the SAN as its own entry. Do clients still use the Common Name? Browsers and Go do not. Some libraries (OpenSSL's host-name check, curl, Python and Node.js) still fall back to the Common Name when the SAN holds no DNS name: no SAN at all, or only IP addresses. Once the SAN lists a DNS name, every client ignores the CN. Can a certificate cover an IP address? Yes, with an IP Address entry in the SAN. A DNS entry that contains the address as text does not count. ## Learn what it checks - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) - [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/)