A security engineer must install the same x.509 certificate on three different servers. The client application that connects to the server performs a check to ensure the certificate matches the host…

A wildcard certificate covers all subdomains of a single domain (e.g., *.example.com) but cannot cover multiple unrelated hostnames or different domain levels, limiting its flexibility for distinct server names.

Extended validation (EV) certificates relate to the rigorous identity vetting process performed by the CA to display a higher-trust indicator in browsers, and do not address the requirement of matching multiple hostnames on a single certificate.

Certificate chaining refers to the trust path from a leaf certificate up through intermediate CAs to a root CA, which is a PKI trust validation mechanism and has nothing to do with assigning a certificate to multiple hostnames.

A SAN (Subject Alternative Name) certificate allows multiple distinct hostnames to be listed within a single certificate's SAN field, enabling one certificate to be deployed across multiple servers while still satisfying hostname validation checks performed by client applications. The client's hostname verification succeeds because each server's FQDN is explicitly listed as a SAN entry in the certificate, making it valid for all three hosts simultaneously.