Sorry for the late response.

The DNSName field in Subject Alternative Name is indeed not very well defined in the specification, but I would say that you should not use any wild cards, because you are not supposed to use the certificate in more than one computer, anyways. If your computer has several hostnames and IP addresses that the clients may connect with, you should list all of them explicitly in the certificate.

In any case, it is meant to be used by servers only, so that clients could verify that the hostname or IP address used in the connection address matches with the DNSNames defined in the certificate – therefore ensuring that the certificates and private keys are not copied over from one server to another – or that the server you are connecting to is the one that you assume. But it therefore also assumes that DNS is reliable in your network. And this verification is not defined for the clients (although it could theoretically be used as well, since the server can verify the IP address of the client connections).

The main identifier in the certificates is the ApplicationUri, for both server and client applications. The certificate is mainly bound to that and the applications typically verify that the certificate is not copied over between applications by verifying this against the ApplicationUri defined by the applications in their ApplicationDescription. Every application are assumed to define a unique ApplicationUri and it typically also contains the hostname. But, it’s still possible to copy the certificate and private key between computers and make it look legitimate, if you can also change the ApplicationUri respectively.

In any case, the main security measure that you should take, is to ensure that the private keys are not and cannot be copied from the applications. This can be done by properly securing the certificate stores (file systems) in which they are stored.

Also, the certificates should be signed by Certificate Authorities instead of using self-signed certificates. By this means, you can ensure that only legitimate applications are allowed in your network and no rogue servers or clients can connect with them. The measures that rely on the Subject Alternative Name are secondary to this and merely defined to avoid accidental copying than rogue applications.

For the reasons mentioned above, we have only applied validations against the ApplicationUri in our SDK for Java or SDK for Delphi or applications. But some other client applications may validate against the DNSName, so you may need to use those definitions. We might also enable the DNSName validation in our client-side SDKs in future.

The Global Discovery Server is a new product that can act as a Certificate Authority and Central Application Directory and we recommend to consider that for your future installations, although we haven’t yet finished support for automatic GDS communication in our SDKs. Please contact our sales for more information about the availability and how you could use it with your own applications.