Some online security checking tools have a database of DNS names linked to an IP.

For example on https://www.ssllabs.com when I request stackoverflow.com (, the result contains :

Alternative names: *.stackexchange.com stackoverflow.com *.stackoverflow.com stackauth.com sstatic.net *.sstatic.net serverfault.com *.serverfault.com superuser.com *.superuser.com stackapps.com openid.stackauth.com stackexchange.com *.meta.stackexchange.com meta.stackexchange.com mathoverflow.net *.mathoverflow.net askubuntu.com *.askubuntu.com stacksnippets.net *.blogoverflow.com blogoverflow.com *.meta.stackoverflow.com *.stackoverflow.email stackoverflow.email

see : https://www.ssllabs.com/ssltest/analyze.html?d=stackoverflow.com&s=

To my understanding of how DNS works, it's impossible to request all names related to an IP address if domain is locked for transfer :

$ dig stackoverflow.com any
;stackoverflow.com.     IN  ANY

stackoverflow.com.  1800    IN  A
stackoverflow.com.  1800    IN  A
stackoverflow.com.  1800    IN  A
stackoverflow.com.  1800    IN  A
stackoverflow.com.  9900    IN  SOA ns-cloud-e1.googledomains.com. cloud-dns-hostmaster.google.com. 1 21600 3600 259200 300

And reverse lookup on ip address will returns only one record (or none) :

$ host
Host not found: 3(NXDOMAIN)

So my question is, how can be built a database that contains 'alternatives names' of an ip address ?


That is not using DNS, it is showing the alternative names (Subject Alternative Name [SAN]) on the certificate, these are all the names that that certificate is also valid for.

One of the uses for a large amount of names is to support clients which don't support Server Name Indication [SNI], as the certificate has to be given before the headers are sent, so the server would send a cert with all the names it could be, so the cert would be valid regardless of which domain was requested.

With SNI this is no longer needed, as the client sends the hostname in plaintext before the certificate is sent, so the server knows which certificate to send, but some clients do not support SNI yet, so a large amount of alternative names is common.

You do not need to keep a database, you can just connect, get the certificate and look at the list of SANs on the certificate, although caching this information may be wise, as some sites may be queried a lot, such as Google.

More Info

  • Wow ! thanks. Didn't know about SAN. I thought one certificate = one domain (except for wildcard certificates). – PierreEmile Sep 7 '17 at 10:36
  • There are a few benefits to SAN, one of which is that one cert can cover multiple depths (a.b.c and b.c), and also different roots (a.b and a.c for example) – jrtapsell Sep 7 '17 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.