certificate host

(is | is not) domain literal name
(like | not like) domain wildcard expression
(matches | not matches) domain regular expression

Purpose

Identify hostnames in a certificate to verify that only desired hostnames are listed (either as CN or SAN) hosts in a certificate.

Notes

This requirement may be repeated in the same section.

Example configuration

[certificate:illinois.edu]
# The literal string *.illinois.edu (a wildcard hostname) is not present
# either as a canonical name (CN) or subject alternative name (SAN) in this certificate.
# Therefore this should generate a warning. Note the difference from the "certificate host not like"
# example below.
certificate host is *.illinois.edu

Example output

Line 9: 1 certificate has no hostname which is “*.illinois.edu”:

Serial Number	Starting	Ending	Hostnames	Validity Length	Remaining Validity
05954D787776425893DBBB28C0A4FAD76236	Fri 2025-07-04 6:05:06 AM	Thu 2025-10-02 6:05:05 AM	2 hostnames: illinois.edu, www.illinois.edu	89 days, 23 hours, 59 minutes, and 59 seconds	49 days, 19 hours, 19 minutes, 30 seconds, and 909 milliseconds

Example configuration

[certificate:illinois.edu]
# The wildcard expression *.illinois.edu should match at least one hostname
# in this certificate (such as www.illinois.edu).
certificate host not like *.illinois.edu

Example output

Line 7: 1 certificate has a hostname which matches “*.illinois.edu” wildcard expression:

Serial Number	Starting	Ending	Hostnames	Validity Length	Remaining Validity
05954D787776425893DBBB28C0A4FAD76236	Fri 2025-07-04 6:05:06 AM	Thu 2025-10-02 6:05:05 AM	2 hostnames: illinois.edu, www.illinois.edu	89 days, 23 hours, 59 minutes, and 59 seconds	49 days, 19 hours, 16 minutes, 50 seconds, and 943 milliseconds

Example configuration

[certificate:illinois.edu]
# At least one hostname in this certificate should match illinois.edu or a subdomain of illinois.edu.
certificate host not matches ^(.*\.)?illinois\.edu

Example output

Line 6: 1 certificate has a hostname which matches /^(.*\.)?illinois\.edu/ regular expression:

Serial Number	Starting	Ending	Hostnames	Validity Length	Remaining Validity
05954D787776425893DBBB28C0A4FAD76236	Fri 2025-07-04 6:05:06 AM	Thu 2025-10-02 6:05:05 AM	2 hostnames: illinois.edu, www.illinois.edu	89 days, 23 hours, 59 minutes, and 59 seconds	49 days, 19 hours, 15 minutes, 10 seconds, and 978 milliseconds