flake8
passed.
JSHint
passed.
Add support for Subject Alternative Names for certificates.
Review Request #14909 — Created March 17, 2026 and updated
SSL/TLS certificates have an optional extension listing alternative
names or IP addresses that the certificate may represent. This change
implements access to these through a newsubject_alternative_names
property, which returns a list of string values for all DNS and IP
addresses listed in the cert.Callers can use this to validate the contents of a cert against other
hostnames. Note that certificates will not be indexed by these names,
just the primary hostname associated with theCertificateobject
(which will usually be the host that was accessed that served the
certificate). For the time being, that makes this more useful as a way
to take an existing certificate and compare it prior to indexing under
the primary hostname.
Unit tests passed.
| Summary | ID |
|---|---|
| 6626d2fe1f294b8ad986a7683ee1d43ec891c743 |
| Description | From | Last Updated |
|---|---|---|
|
Based on the implementation, this is returning all GeneralName entries, which could include more than just DNS and IP addresses. … |
 david
|
|
|
This should be broadened to at least say something like "SAN values", since it's including IP addresses (and potentially other … |
david
|
|
|
This was copy/pasted from another test, and needs to be updated. |
david
|
-
-
Based on the implementation, this is returning all
GeneralNameentries, which could include more than just DNS and IP addresses. We should either explicitly get values for onlyx509.DNSName/x509.IPAddresstypes, or change the docstring here to mention that this can also include things like e-mail addresses, URIs, directory names, etc. -
This should be broadened to at least say something like "SAN values", since it's including IP addresses (and potentially other things depending on your decision above).
-