http - 为什么 TLS 允许颁发给不同子域的证书？

Question

我最近发现了一些东西，对我自认为对 TLS 的了解提出了质疑。

本站https://int.lyve-lyon.alpha.grandlyon.com受 TLS 保护，但证书实际上颁发给 rec.lyve-lyon.alpha.grandlyon.com。

服务器如何提交为不同主机颁发的证书，浏览器如何不抛出 TLS 错误？证书看起来像通配符，我不明白为什么。

Answer 1

Subject Alternative Name (SAN) is an extension to X.509 that allowsvarious values to be associated with a security certificate using asubjectAltName field. These values are called Subject AlternativeNames (SANs). Names include:

1. Email addresses
2. IP addresses
3. URIs
4. DNS names (this is usually also provided as the Common Name RDN within the Subject field of the main certificate.)
5. directory names (alternative Distinguished Names to that given in the Subject)
6. other names, given as a General Name: a registered[3] object identifier followed by a value

from https://en.wikipedia.org/wiki/Subject_Alternative_Name