Enginsight Highlights Certificate Errors Due to Missing Subject Alternative Names

Enginsight, a company specializing in IT security, has highlighted a critical issue affecting website security and accessibility. Recent changes in web browser policies mean that missing or incorrectly configured Subject Alternative Name (SAN) fields in SSL/TLS certificates can lead to errors for visitors.

Specifically, Google Chrome version 58 and subsequent versions have ceased to fall back to the Common Name (CN) field for domain validation if the SAN field is absent or contains incorrect information. This means that websites relying on the older CN method will now present users with error messages, potentially deterring visitors and impacting online operations.

The relevant standard, RFC 2818, outlines two primary methods for validating a domain name against a certificate. It mandates that if a dNSName entry exists within the SAN extension, that must be used. If no such entry is present, the Common Name field in the certificate's Subject field should be used. However, the RFC explicitly states that the use of the Common Name is deprecated, and certificate authorities are encouraged to use dNSName instead.

While many SSL/TLS clients still support the fallback to the Common Name, this practice is becoming obsolete. Enginsight offers a platform that can identify certificates lacking the necessary SAN information or those with invalid entries, allowing organizations to rectify these issues proactively before they cause widespread access problems for their users.