What did you do?

I tried to scrape a TLS protected target which has multiple 'Subject Alternative Name' in its cert

What did you expect to see?
Scrape works without any error

What did you see instead? Under which circumstances?
An error on the Prometheus target page:
2021-09-27T09:23:44,312+00:00 WARN [SparkUI-43] org.sparkproject.jetty.server.SecureRequestCustomizer: Host 172.17.0.8 does not match SNI X509@47daa1b2(my-cert,h=[domain1, domain2],w=[])

Environment

• Prometheus version: 2.15.2

• Prometheus configuration file:

  - job_name: tls-target
    scheme: https
    tls_config:
      ca_file: /run/secrets/cacert/ca.pem
      cert_file: /run/secrets/clicert/cert.pem
      key_file: /run/secrets/clicert/key.pem
      server_name: domain1
    kubernetes_sd_configs:
      - role: pods
  

• Server cert relevant part

            X509v3 Subject Alternative Name:
                DNS:domain1, DNS:domain2

• Logs:
  - No logs on Prometheus side
  - Log message on target side :2021-09-27T09:23:44,312+00:00 WARN [SparkUI-43] org.sparkproject.jetty.server.SecureRequestCustomizer: Host 172.17.0.8 does not match SNI X509@47daa1b2(my-cert,h=[domain1, domain2],w=[])

What works

1. Either curling the target by hand https://domain1:4440/metrics/prometheus. It gives back the metrics successfully
2. Or removing one SAN entry from the server cert(In this case Prometheus can scrape the metrics successfully):

            X509v3 Subject Alternative Name:
                DNS:domain1