Technical Tip: Details regarding the SAN field in Local certificate

[guptas]

Description	This article describes how many entries and characters the SAN field can accept in the GUI/CLI.
Scope	FortiADC.
Solution	When the admin uploads a Local certificate under System -> Manage Certificates -> Local Certificate, it will display the certificate details along with the Subject Alternative Name (SAN).  FortiADC Local certificate GUI can only show 255 characters.  If the admin added, let's say 60 SAN entries in CSR, when uploading the certificate in FortiADC, it will display 5-8 entries depending on the length, as 1 character, a space will take 1 byte. In the backend, FortiADC will have 4096 bytes for the SAN field, so it can accommodate 4096 characters, including spaces. If the SAN field entry length is more than 4096, then the backend will not add the entry, and when the user accesses the domain, they will get the certificate warning as the requested domain will not be present in the shared certificate SAN field due to the length limitation of SAN. Note: The above scenario will apply only when the admin does not generate a Certificate Signing request (CSR) from FortiADC, as if the Certificate Signing request (CSR) is generated from FortiADC GUI, then the SAN length limitation is 1024 bytes only, which means the admin can add only 1024 characters, including space for each entry.  If more entries need to be added, then CSR must be generated from some other device, not from FortiADC.