Citizens call https://permits.city.example for a civic API, but the installed certificate lists only CN/SAN for dev.permits.city.example. Clients reject the handshake. What is wrong with the application certificate configuration?
Select an answer to reveal the explanation.
Short Explanation
The name on the badge has to match the door you open—clients check SAN/CN against the URL host. A dev-only name on the production hostname is simply the wrong identity installed.
Full Explanation
Clients verify the certificate hostname (SAN or CN) against the host they contacted. Installing a certificate for a development name on the production API hostname is an application-cert misconfiguration. Cipher-suite brand choices, IPsec, and stuffing CA roots into the leaf SAN are not the failure mode this scenario describes.