SSL / TLS / Certificates
Compare a SAN list or one PEM certificate against hostnames and IP addresses, one target per line.
Inputs stay in this browser. No certificate upload or connection to the target is made.
SAN list: DNS:name, IP:address or IP Address:address. Targets: one bare hostname or IP per line.
Up to 100 SANs and 100 targets; 65,536 characters per field. Results appear 50 rows at a time.
Name coverage only. No CN fallback, trust, expiry, revocation or public-suffix checks.
Input changed. Match again before exporting.
A certificate hostname matcher helps investigate a certificate name mismatch before changing a server configuration. A familiar domain in the certificate subject is not enough: the requested identity must be covered by a SAN of the right type.
Use the mixed example to see the difference between a missing name, a wildcard at the wrong depth and an input that is not a hostname. The report keeps those outcomes separate so an invalid URL cannot look like an ordinary uncovered domain.
The certificate hostname matcher treats *.example.com as exactly one extra label. api.example.com can match; example.com and deep.api.example.com cannot match that wildcard. An explicit SAN can still cover either name.
A DNS entry containing 192.0.2.1 is not an IP address SAN. IP targets follow the IP path; internationalized DNS targets are converted to ASCII before name comparison, with the normalized value visible in each result.
The SAN hostname check accepts DNS:, IP: and IP Address: entries separated by newlines or commas. PEM mode accepts one complete certificate block, not a chain.
Write bare hostnames or bare IP addresses, without a scheme, port, path, brackets or IPv6 zone ID. One terminal DNS dot is removed for comparison.
Auto matching waits 350 ms after an edit. Turn it off to use the match button or Ctrl/Cmd + Enter. Any input change disables exports until matching finishes.
Each target keeps its physical input line, normalized identity, match status and reason code. A successful row also names the SAN that matched. Duplicate targets remain separate diagnostic rows.
Compressed and expanded spellings of the same IPv6 address compare equally. An IPv4-mapped IPv6 value remains IPv6 and does not match a four-byte IPv4 SAN. No IP wildcard or network-prefix matching is performed.
Copy or download JSON for the complete report, including parsed SANs and ignored type count. CSV exports target rows with stable field names and reason codes; formula-like cells receive a protective apostrophe.
Only one star, occupying the complete leftmost label, is supported: *.example.com. It matches exactly one nonempty label. www*.example.com and *.*.example.com are source errors, not glob patterns.
The wildcard alone does not. *.example.com matches www.example.com but not example.com. Add a separate DNS:example.com entry to cover the apex, then check the two targets independently.
No. An IP SAN contains one exact IPv4 or IPv6 address. Use IP:192.0.2.1, not IP:192.0.2.*. A DNS entry that happens to contain dotted numbers cannot substitute for an IP SAN.
The certificate lacks the SAN evidence needed for this check. This tool does not use the subject Common Name as a substitute. Supply a certificate with the appropriate DNS or IP SAN rather than disabling hostname verification.
SAN is the extension that can hold several named identities. A wildcard is a DNS naming pattern that can appear inside that extension. One certificate can therefore have exact names, wildcard DNS names and IP entries together.
Still have a question?
Use the certificate hostname matcher with the exact hostname your client requests, review the matching SAN and reason, then save the report before changing a certificate or endpoint.