CNAME record declares that
an.orange.com is an alias for the canonical name
This means that when a client looks up some record type (eg
an.orange.com the response will effectively have the
A record for
In a regular application, like the web browser in your example, the application doesn't know or care that there was an indirection in the form of a
CNAME record as as part of the name resolution process (which it is largely blind to the internals of), it just uses the resulting IP address.
With this in mind, when the user navigates to
https://an.orange.com/ in their web browser, the browser is set on connecting to the host portion of the url (
an.orange.com), it resolves this name, gets an IP address, connects, it then fully expects a valid certificate for the host from the current URL in case of HTTPS, it then sends the Host header with the host portion of the current URL (
an.orange.com) as part of their request.
The is wildly different from how a web browser reacts to an HTTP redirect, where it is told to navigate to a different URL, restarting the entire navigation process with all new expectations (eg, now attempting to connect to
For HTTPS, this has the implication that if you want to allow users to navigate to
https://an.orange.com/ you must have a valid certificate for this name.