CN at SSL third party certificate Authority

[gentjan]

I need to be clarify related with CN name in SSL certificate that will be installed in  5520HA SSO WLCs.

The system name in primary controller is ERW-MOD-RAC3-MCC1-01,

I need to define the CN in Certificate signing request and I am not sure about the right CN name.

What is the CN name ?

What is the impact if the CN name is wrongly defined?

[Rich R]

The CN and the SAN (Subject Alternative Name) "DNS name" should both exactly match the FQDN which will be used to access the WLC.
For example ERW-MOD-RAC3-MCC1-01.mycompany.com

[gentjan]

Thanks a lot for the answer, Can I have a clear idea what is the impact on the clients if the CN is wrongly defined within the CA and can be installed in the WLC is wrongly defined or WLC doesn't allow it to hap[pened?

[ammahend]

If CN is wrong and certificate is installed on WLC, you might get issues accessing WLC webpage. If you are going local web auth the clients will get certificate error when being redirected to WLC. 

[ammahend]

CN (common name) is just an attribute, this common name typically represents the hostname of the server to which certificate is issued, if you want the same certificate to be issued to multiple servers you can use their name in SAN (subject alternative name) and have a single certificate instead of multiple certificate for multiple servers. Usually the limit is 5 but depends on the CA signing the certificate. 
If the CN is wrong but one of the SAN is still correct then I don’t think you will have any issue. But if you only have CN and it’s wrong, it means the certificate is issued to for wrong server, so when you do https://fqdn it will still show cert error, because the Requested hostname must match CN on certificate for the certificate to be validated. If you do run into this situation, change host name same as CN and update DNS record and I think you should be good, or just generate a new CSR with correct CN.

[Rich R]

Adding to what @ammahend has said as security gets stricter on clients some may still give a cert error but some will simply block the connection completely so the client will never be able to open the captive portal page at all.
If you want it to work the name used for https *must* match exactly to CN or SAN.