Subject Alternative Name
The list of names a certificate is valid for; the hostname check uses it.
The Subject Alternative Name extension lists DNS names and IP addresses a certificate covers; under RFC 9525 the dialled name must match one, and the CN is ignored when SANs exist.
Examples
A node that dials
broker.greenhouse.exampleaccepts the leaf only if that name appears in its Subject Alternative Name list.A typo in the hostname, or a certificate issued for a different name, fails the SAN check even though the chain is valid.
See also