SANS in acme.json vs SANS in dumped certificate about traefik-certs-dumper

[ldez]

There is no identity between main/sans and Subject/Subject Alt Names because, in the internal of Traefik, lego, and the ACME server, there is only a list of domains without real order.

There is no identity between main/sans in the Traefik configuration and the acme.json file because the domains are re-ordered during the certificate generation process.

[ldez]

Hello,

Common Name has been deprecated since 2000.

The order of domains can be changed during the certificate generation by Traefik, lego, or the ACME server.

The domain inside the certificates may be different from the list because it depends on your traefik configuration: traefik-certs-dumper doesn't "generate" certificates from main and sans, it just extracts them from the acme.json file.

[francescor]

thanks when I check a certificate with Firefox I see that "Common Name" and the "Sabject Alt Names": those are, I suppose, the Subject: CN and X509v3 Subject Alternative Name: I get from the output of openssl x509 -text -noout -in mycert.pem

I would expect a 1:1 relationship between these 2 fields and the main and sans in the Traefik acme-http.json file.

Since you just extract the certificate (yes, I've got that) that is probably not true?