The 64 Character Limit on the Common Name Field
Andrew JohnsonShare
Long hostnames run into a wall that surprises everyone the first time. The Common Name (CN) field of an SSL Certificate accepts a maximum of 64 characters, a structural limit inherited from the X.509 standard itself, and a Fully Qualified Domain Name (FQDN) one character over it cannot be placed there at all.
The good news is that the limit stopped mattering for trust years ago, and a longer hostname secures perfectly well through a different field.
Where the Limit Bites
The failure usually appears at Certificate Signing Request (CSR) generation, with OpenSSL refusing the subject as too long, or a control panel rejecting the hostname field. Deeply nested subdomains are the usual culprits, the kind produced by cloud platforms, regional naming schemes, and machine generated environments.
Counting includes every character of the full hostname, dots included, so a name that looks borderline often measures over.
The Limit Stopped Mattering for Trust
Browsers stopped reading the Common Name (CN) for hostname matching long ago. The Subject Alternative Name (SAN) entries are the authoritative list of what an SSL Certificate covers, every modern client validates exclusively against them, and SAN entries accommodate hostnames up to the full length the Domain Name System (DNS) itself allows.
A hostname too long for the Common Name (CN) therefore secures exactly as well as a short one, provided it appears as a SAN entry, which is where coverage genuinely lives. Learn About Understanding SAN Certificates 🔗
Ordering for a Long Hostname
The practical approach places a shorter name in the Common Name (CN) and the long hostname among the SAN entries. The parent domain or a shorter sibling hostname both work well as the subject, keeping Certificate Signing Request (CSR) generation happy while the SAN list carries the names that matter.
A Multi-Domain SSL Certificate is the natural fit when several long hostnames need coverage together, since its entire design revolves around the SAN list. Learn About Multi-Domain SSL Certificates 🔗
Tip : A Wildcard SSL Certificate sidesteps the question entirely for deep single-level subdomains, covering every name at that level regardless of length, which often suits the machine generated naming schemes that trigger the limit in the first place.
Whichever shape the order takes, generation follows the same pattern.
Generating the Request
Generate the Certificate Signing Request (CSR) with the shorter subject and supply the long hostname during ordering, where it joins the SAN list. Platform guides for generation are collected in one place. Learn About Generating a CSR 🔗
The issued SSL Certificate then lists every covered name in its SAN entries, the long hostname validates and serves normally, and the 64 character ceiling never enters the picture again.
A Related Pitfall Worth Knowing
Errors naming the Common Name (CN) usually trace to coverage rather than length, with clients connecting to a hostname the SSL Certificate simply does not list. The two problems look similar from the browser and resolve very differently. Learn About SSL Common Name Mismatch Explained 🔗
