A sertificate can be locked to a specific host, specifying the "Subject: CN=hostname"
But this CN statement is deprecated because it can only specify a single host. Now an X509v3 extension is used, "Subject Alternative Name" that supports multiple hosts.