To view Subject Alternate Names (SANs) in Google Chrome, click the padlock icon next to the URL and select Certificate. Navigate to the Details tab and scroll down to locate the Subject Alternative Name field, which lists all domain aliases secured by that specific certificate.
Accessing the Certificate Viewer
The most direct method to inspect SSL/TLS certificates involves using the built-in security interface located in the address bar. This tool provides immediate access to the cryptographic details without requiring external command-line tools or third-party extensions.
Begin by navigating to any website secured with HTTPS. Look at the left side of the address bar for a small padlock icon. Click on this icon to open a dropdown menu containing basic connection information. Select the option labeled "Connection is secure" or simply "Certificate" depending on your version of Chrome. This action opens a modal window displaying the certificate hierarchy and detailed metadata about the site's identity.
Navigating to Subject Alternate Names
Once the certificate viewer is open, you must navigate through the tabs to find the specific data points related to hostnames. The default view often shows the Issuer and Validity dates, but the SANs are stored in a different section.
Click on the "Details" tab within the certificate popup. This tab presents a hierarchical tree of certificate fields. Scroll down the list until you find an entry labeled "Subject Alternative Name". In modern certificates, this field is critical because it contains the actual hostnames associated with the public key. If the certificate was issued before the widespread adoption of SANs, you might only see the "Common Name" (CN), but most current certificates will explicitly list multiple domains here.
Expand the "Subject Alternative Name" row if necessary. You will see a comma-separated list of DNS names, IP addresses, or email addresses. Each entry represents a valid hostname that the certificate protects. For example, a certificate might cover
example.com,
www.example.com, and
api.example.com. All these names appear under this single field.
Using Command Line Alternatives
While the browser UI is convenient, developers often prefer command-line verification for scripting or bulk checking. You can use OpenSSL to retrieve the same information directly from the terminal. Run the following command, replacing
example.com with your target domain:
openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"
This pipeline connects to the server, extracts the certificate text, and filters for the SAN line. The output will mirror what you see in the Chrome interface, providing a reliable way to verify the certificate content programmatically.
Interpreting the Results
Understanding what you see in the Subject Alternative Name field is crucial for troubleshooting connectivity issues or verifying security configurations. A missing SAN does not necessarily mean the certificate is invalid, but it may indicate legacy configuration practices.
If you see only one domain listed, ensure it matches the exact hostname you are visiting. Browsers strictly enforce hostname matching against the SAN list. If you visit
sub.example.com but the SAN only lists
example.com, the connection will fail with a certificate error unless the certificate includes a wildcard like
*.example.com. Wildcards are also displayed in the SAN field, prefixed with an asterisk.
Additionally, check for the presence of IP addresses in the SAN list. Some internal systems or testing environments use IP-based certificates. These entries will appear as
IP Address: followed by the numerical address. Ensure that the IP you are accessing matches one of these entries exactly.
Troubleshooting Common Issues
Sometimes the certificate viewer may not display all expected domains due to caching or intermediate certificate issues. If you suspect the certificate is incomplete, try clearing your SSL state or restarting the browser. On Windows, you can clear the SSL state via Internet Options in the Control Panel. On macOS, you may need to restart the Keychain Access application.
For more advanced diagnostics, use the Chrome DevTools. Open the Network tab and reload the page. Click on the main document request and look at the Security panel. This view provides a summarized overview of the certificate chain, including any warnings about missing SANs or deprecated algorithms.
If you are managing multiple subdomains, ensure your SSL provider supports SAN certificates. Many providers allow you to add up to 100 domains to a single certificate. This approach reduces management overhead compared to purchasing separate certificates for each subdomain. For more information on managing browser settings that might affect certificate validation, see
How to Disable Chrome Autofill Suggestions from Browsing History on Android.
Frequently Asked Questions
Why does my certificate show only one domain in the Common Name?
Modern browsers ignore the Common Name field for hostname validation and rely exclusively on the Subject Alternative Name field. Even if the CN lists a domain, the browser checks the SAN list first. If the SAN list is empty or does not contain the visited hostname, the connection will be marked as insecure.
Can I view SANs for HTTP websites?
No, Subject Alternate Names are part of SSL/TLS certificates, which are only used for HTTPS connections. HTTP sites do not establish a secure channel and therefore do not present a certificate. You must navigate to the HTTPS version of the site to view these details.
What should I do if the SAN list is missing?
If the SAN field is absent, the certificate is likely outdated or misconfigured. Contact your web hosting provider or SSL certificate issuer immediately. They need to reissue the certificate with the correct domains included in the SAN extension. Do not attempt to modify the certificate yourself.
Do wildcard certificates appear differently in the SAN field?
Yes, wildcard certificates appear with an asterisk prefix, such as
*.example.com. This notation indicates that the certificate is valid for any single-level subdomain of
example.com. It does not cover multi-level subdomains like
mail.sub.example.com.
How do I verify if a certificate covers a specific IP address?
Check the Subject Alternative Name field for entries starting with "IP Address:". If the IP you are connecting to is not listed there, the certificate will not validate for that IP. You may need to configure your server to use a certificate that includes the specific IP address in its SAN list.