diff --git a/roles/client_pki/defaults/main.yml b/roles/client_pki/defaults/main.yml
index a378b86..588b894 100644
--- a/roles/client_pki/defaults/main.yml
+++ b/roles/client_pki/defaults/main.yml
@@ -13,6 +13,13 @@ client_pki_nom_cert: "{{ ansible_fqdn | default(ansible_hostname) }}"
 client_pki_cert: "{{ client_pki_steppath }}/certs/{{ client_pki_nom_cert }}.crt"
 client_pki_cle: "{{ client_pki_steppath }}/certs/{{ client_pki_nom_cert }}.key"
 
+# SANs du certificat (FQDN + nom court + IP). Requis pour un mTLS moderne :
+# les clients TLS valident par le SAN, pas par le CN.
+client_pki_sans:
+  - "{{ client_pki_nom_cert }}"
+  - "{{ ansible_hostname | default('') }}"
+  - "{{ ansible_host | default('') }}"
+
 # Secrets OBLIGATOIRES (Ansible Vault).
 client_pki_ca_fingerprint: "{{ vault_step_ca_fingerprint | default('') }}"  # rempli depuis la voute (vault_step_ca_fingerprint)
 client_pki_provisioner_password: "{{ vault_step_ca_provisioner_password | default('') }}"  # rempli depuis la voute (vault_step_ca_provisioner_password)
diff --git a/roles/client_pki/tasks/main.yml b/roles/client_pki/tasks/main.yml
index a954b0d..160441f 100644
--- a/roles/client_pki/tasks/main.yml
+++ b/roles/client_pki/tasks/main.yml
@@ -73,6 +73,7 @@
       {{ client_pki_cert }} {{ client_pki_cle }}
       --provisioner {{ client_pki_provisioner }}
       --provisioner-password-file {{ client_pki_steppath }}/provisioner.pass
+      {% for s in client_pki_sans | select | unique %}--san {{ s }} {% endfor %}
       --force
     creates: "{{ client_pki_cert }}"
   environment: