[semi]

surprisingly it's been deprecated since RFC 2818 was published 24 years ago.

It's only more recently that browsers and other common software stopped validating it though

[throw0101c]

    If a subjectAltName extension of type dNSName is present, that MUST
    be used as the identity. Otherwise, the (most specific) Common Name
    field in the Subject field of the certificate MUST be used. Although
    the use of the Common Name is existing practice, it is deprecated and
    Certification Authorities are encouraged to use the dNSName instead.

* https://datatracker.ietf.org/doc/html/rfc2818#section-3.1

    Therefore, if and only if the presented identifiers do not include a
    DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types
    supported by the client, then the client MAY as a last resort check
    for a string whose form matches that of a fully qualified DNS domain
    name in a Common Name field of the subject field (i.e., a CN-ID).  If
    the client chooses to compare a reference identifier of type CN-ID
    against that string, it MUST follow the comparison rules for the DNS
    domain name portion of an identifier of type DNS-ID, SRV-ID, or
    URI-ID, as described under Section 6.4.1, Section 6.4.2, and
    Section 6.4.3.

* https://www.rfc-editor.org/rfc/rfc6125#section-6.4.4

Also from 2015:

    9.2.2 Subject Distinguished Name Fields
    a. Subject Common Name Field
    Certificate Field: subject:commonName (OID 2.5.4.3)
    Required/Optional: Deprecated (Discouraged, but not prohibited)
    Contents: If present, this field MUST contain a single IP address
    or Fully-Qualified Domain Name that is one of the values contained
    in the Certificate’s subjectAltName extension (see Section 9.2.1).

* https://cabforum.org/wp-content/uploads/BRv1.2.5.pdf#page=17

* https://stackoverflow.com/questions/5935369/how-do-common-na...