The TLS protocol requires the server to present a digital certificate, proving that it is the intended destination.
The connecting client conducts certification path validation, ensuring that:
- The subject of the certificate matches the hostname (not to be confused with the domain name) to which the client is trying to connect.
- A trusted certificate authority has signed the certificate.
The
Subjectfield of the certificate must identify the primary hostname of the server as the Common Name.
A certificate may be valid for multiple hostnames (e.g., a domain and its subdomains).
Such certificates are commonly called Subject Alternative Name (SAN) certificates or Unified Communications Certificates (UCC).
These certificates contain the Subject Alternative Name field, though many CAs also put them into the Subject Common Name field for backward compatibility.
If some of the hostnames contain an asterisk (*), a certificate may also be called a wildcard certificate.Once the certification path validation is successful, the client can establish an encrypted connection with the server.
Internet-facing servers, such as public web servers, must obtain their certificates from a trusted, public certificate authority (CA).
en.wikipedia.org/wiki/Public_key_certificate#TLS/SSL_server_certificate