On 2026-09-20, Thomas Kupper <[email protected]> wrote: > Hi, > > As the subject hints, the certificate for man.openbsd.org does not > contain SANs for man.openbsd.{net,com}: > > $ openssl s_client -connect man.openbsd.org:443 </dev/null 2>/dev/null \ >| openssl x509 -noout -text | grep DNS: > DNS:man.openbsd.org > > On the other hand all three domains point to the same server: > > $ for t in org net com; do dig a man.openbsd.$t +short @9.9.9.9; done > 128.100.17.244 > 128.100.17.244 > 128.100.17.244 > > It would make sense to provide a cert that includes all three domains
We aren't really using the other domains, the canonical hostnames are man.openbsd.org, www.openbsd.org, etc. Others may work for some things but not recommended to use them at all.
