An engineer must create and sign a new certificate for all the portals in a...

When wildcard certificates are prohibited, every portal hostname that clients might access must be explicitly included in the certificate’s Subject Alternative Name extension. Modern browsers and operating systems validate the requested portal FQDN primarily against the SAN entries rather than relying only on the Common Name. The engineer should therefore add each guest, sponsor, BYOD, client-provisioning, and other applicable portal FQDN to the SAN field before submitting and signing the certificate request. A single Common Name cannot represent multiple distinct portal names reliably. DNS AAAA records merely map hostnames to IPv6 addresses and do not make those hostnames valid identities within a certificate. Creating a record for the Administration node also does not protect portal URLs unless that exact hostname is used. Explicit SAN entries provide the required hostname validation without using a wildcard.