Entries are typed: dNSName (example.com, *.example.com), iPAddress (4 or 16 bytes), rfc822Name for S/MIME, uniformResourceIdentifier for SPIFFE IDs and similar, and otherName for things like Microsoft UPNs. Host name matching follows RFC 6125, updated by RFC 9525: wildcards match exactly one left-most label, so *.example.com covers www.example.com but not example.com or a.b.example.com.
Chrome has ignored the subject commonName since version 58 (2017), so a certificate whose name appears only in CN fails with ERR_CERT_COMMON_NAME_INVALID. Go, Python and OpenSSL clients also require SAN for host names. A certificate with an empty subject must mark SAN as critical (RFC 5280 §4.2.1.6).
Public TLS certificates may contain many SANs; each name must be validated separately and every one of them is published in Certificate Transparency logs, which is why internal host names in public certificates become public.