The key point
A SAN certificate covers its listed names. Count each hostname explicitly and check the product allowance before buying.
What it covers
A multi-domain certificate contains a Subject Alternative Name (SAN) list of the hostnames it secures. Different domains can share one certificate. Included names, additional SAN pricing and maximum capacity depend on the product.
Every name needs authorisation
The CA must establish authorisation for every requested name. A permitted base-domain check can sometimes cover related subdomains, but do not assume a single challenge completes the whole order. Follow the status and instructions shown for each name.
Multi-Domain or Wildcard?
A wildcard covers matching subdomains at one level. A SAN product covers an explicit set of names across domains. Some products support wildcard SANs, but an ordinary SAN allowance does not grant a wildcard upgrade. Changing DV, OV or EV also requires a suitable product.
Worked example
One business with three public hostnames
Suppose visitors use example.com, www.example.com and shop.example.net. Put all three in your hostname inventory, even when two addresses lead to the same site.
- example.com
- An explicit name in the requested coverage.
- www.example.com
- A separate hostname. A redirect does not make it automatically covered.
- shop.example.net
- A name on another domain, supported by an appropriate SAN product.
- api.example.net added later
- With a Multi-Domain product, you can add it through reissue with no extra SAN licence charge while it fits the purchased allowance. The new name still needs validation.
Your next steps
- Write the exact hostname list, without https://, ports or URL paths.
- Check included names, additional SAN pricing and the maximum product allowance.
- Confirm that you can validate every requested name. Inspect the SAN list again after issuance.