TLS Certificate Name Mismatch: What a Client Actually Compares (RFC 9525)
What a TLS client compares with the certificate's SAN under RFC 9525: reference identifiers, DNS-ID and IP-ID, the Common Name ban, wildcards, mismatch handling, and a checklist.
TLScertificatesRFC 9525PKIsecurity