# No subject alternative name matching found for SSL cert even though common name is correct in Native Launcher **URL:** \ **Category:** Ignition\ **Created:** [June 18, 2025, 4:13pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531 "2025-06-18T16:13:37Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![framebuilder](https://avatars.discourse-cdn.com/v4/letter/f/96bed5/32.png) [@framebuilder](https://forum.inductiveautomation.com/u/framebuilder)\ **Post date:** [June 18, 2025, 4:13pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531/1 "2025-06-18T16:13:37Z")
Hi everyone, We are enabling SSL/TLS on our Gateway. We have a internal CA-provided cert and the entire chain has been added to the Gateway following IA's documentation. Our CSR and assigned cert includes the following: Common Name: FQDN - something like ignition25.domain.global SAN: ignition25 SAN: 192.168.1.125 When I use the Native Launcher and try to add a Gateway with FQDN, I get the following error when clicking "Trust" saying there's no subject alternative DNS name matching ignition25.domain.global ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/4/54e1a6cf9d21fff88f31035d0548c67412e17287.png) The .pem file gets added to .ignition\clientlauncher-data\certificates Web browsing to [https://ignition25.domain.global:8043](https://ignition25.domain.global:8043) works fine Web browsing to [https://ignition25:8043](https://ignition25:8043) works fine I have tried various Launcher versions from 1.1.11 to 1.1.48 and all exhibit the same behavior. If I add the Gateway in the Launcher with only the hostname [https://ignition25:8043](https://ignition25:8043) it works fine. Why is the Native Launcher not using the Common Name for cert validation, and instead looking inside of the SAN? I can't find any documentation anywhere that says a SAN "must" include the Common Name/FQDN ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 18, 2025, 4:16pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531/2 "2025-06-18T16:16:47Z")
> [@framebuilder](#): > > I can't find any documentation anywhere that says a SAN "must" include the Common Name/FQDN This has been common practice internet-wide for years now. I'll see if I can find some docs for you, but you need to put all of the domain names under SAN entries. Using the CN has been a deprecated practice for a while. ---
**Author:** ![framebuilder](https://avatars.discourse-cdn.com/v4/letter/f/96bed5/32.png) [@framebuilder](https://forum.inductiveautomation.com/u/framebuilder)\ **Post date:** [June 18, 2025, 4:17pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531/3 "2025-06-18T16:17:50Z")
Thanks @Kevin.Herron - I found some info online where it was recommended but didn't know it was required. I'll add it. Thanks for the quick response ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [June 18, 2025, 4:24pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531/4 "2025-06-18T16:24:24Z")
[This](https://cabforum.org/working-groups/server/baseline-requirements/requirements/#7143-subscriber-certificate-common-name-attribute) states that if a CN is present, it must be an exact copy of one of the SAN entries, which implies your FQDN and other hostnames must be in the SAN entries, and the CN is optional. Got pulled into a meeting, can't dig around any more right now. ---
**Author:** ![framebuilder](https://avatars.discourse-cdn.com/v4/letter/f/96bed5/32.png) [@framebuilder](https://forum.inductiveautomation.com/u/framebuilder)\ **Post date:** [June 18, 2025, 4:27pm UTC](https://forum.inductiveautomation.com/t/no-subject-alternative-name-matching-found-for-ssl-cert-even-though-common-name-is-correct-in-native-launcher/107531/5 "2025-06-18T16:27:13Z")
Good enough for me. Thanks again