Website security is essential for protecting user data and building trust online. One of the most important components of website security is an SSL/TLS certificate, which encrypts communication between a browser and a web server.
However, users and website owners may sometimes encounter SSL certificate errors that prevent secure connections. One of the most common SSL errors is ERR_CERT_COMMON_NAME_INVALID.
This error occurs when the domain name in the SSL certificate doesn’t match the website address the user is trying to access. As a result, browsers cannot verify the website’s identity and display a security warning.
In this guide, we’ll explain what the ERR_CERT_COMMON_NAME_INVALID error means, why it occurs, how to fix it, and best practices to prevent it.
The ERR_CERT_COMMON_NAME_INVALID error indicates that the SSL certificate installed on a website does not match the domain name being accessed.
For example:
Website URL:
SSL Certificate:
example.com
Because the certificate was issued for example.com and not www.example.com, browsers display:
Your connection is not private
NET::ERR_CERT_COMMON_NAME_INVALIDThe browser cannot verify that the website is legitimate.
An SSL certificate is a digital certificate that:
The Common Name (CN) is the domain name for which the SSL certificate is issued.
Examples:
example.com
www.example.comsubdomain.example.com
The browser checks whether the URL matches the certificate’s Common Name or Subject Alternative Names (SANs).
When a user visits a website:
Workflow:
Browser Request
↓
SSL Certificate Received
↓
Domain Name Matches?
┌─────────────┐
│ Yes │ → Secure Connection
└─────────────┘
↓ No
ERR_CERT_COMMON_NAME_INVALIDSeveral issues can trigger this error.
This is the most common cause.
Example:
Because the domains don’t match, the browser shows the error.
Additional lines:
A browser expects the certificate’s common name or Subject Alternative Name (SAN) to match the exact domain being visited. Even a small mismatch causes the SSL verification to fail, resulting in this error.
Many websites forget to include both versions of their domain in the SSL certificate.
Examples:
Both should be covered by the certificate.
Additional lines:
If your certificate only secures one version, visitors using the other version may encounter security warnings. Configuring proper redirects and including both hostnames in the certificate helps prevent this issue.
Example:
The certificate does not cover the subdomain.
Additional lines:
Unless you’re using a wildcard or multi-domain certificate, each subdomain requires its own SSL coverage. This issue commonly appears when new subdomains are added without updating the certificate.
The server may have:
This commonly occurs on shared hosting environments.
Additional lines:
Incorrect certificate installation can also happen after server migrations or manual configuration changes. Verifying the installed certificate chain and server settings can quickly identify the mismatch.
Development servers often use self-signed certificates.
Browsers cannot properly verify them and may display certificate warnings.
Additional lines:
Self-signed certificates are suitable for testing but should never be used on production websites. Public-facing sites should always use certificates issued by a trusted Certificate Authority (CA).
Services like:
can cause certificate mismatches if SSL settings are configured incorrectly.
Additional lines:
If the origin server and CDN use different SSL configurations, visitors may receive certificate errors even when the certificate itself is valid. Reviewing SSL modes and edge certificate settings usually resolves the problem.
After migrating or renewing certificates, DNS and server configurations may still reference the previous certificate.
Additional lines:
Browser or CDN caches may also continue serving an outdated certificate for a short period after renewal. Clearing caches and confirming the active certificate on the server can help eliminate the error.
Temporary SSL issues can occasionally resolve after refreshing.
Additional lines:
Sometimes the browser loads an outdated SSL certificate due to a temporary network or caching issue. A simple refresh can force the browser to request the latest certificate from the server.
Old SSL information may be stored in the browser.
Chrome
Additional lines:
Cached website data or stored SSL information may prevent the browser from recognizing a newly installed certificate. Clearing the cache ensures the browser retrieves fresh security information.
Ensure you’re visiting the correct version:
instead of:
if only one version is configured.
Additional lines:
A website certificate may only be valid for one domain variation. Using the correct URL or allowing the site to redirect automatically can help avoid certificate mismatch errors.
Incorrect device time can interfere with certificate validation.
Windows
Settings → Time & Language → Date & TimeEnable:
Additional lines:
SSL certificates have specific validity periods, and an incorrect system clock may make a valid certificate appear expired or not yet active. Synchronizing your device’s date and time usually resolves this problem.
Some antivirus software intercepts SSL connections.
Temporarily disable:
Then try accessing the website again.
Additional lines:
Certain security programs replace website certificates with their own for scanning purposes, which can trigger certificate mismatch errors. If disabling HTTPS scanning fixes the issue, update your antivirus settings or contact the software vendor for guidance.
Ensure the certificate matches your domain.
Example:
Additional lines:
Verify that the installed certificate is issued for the exact domain visitors use to access your website. If multiple domains point to the same server, each one should be covered by the certificate or redirected appropriately.
Modern certificates support multiple domains.
Example:
SAN certificates prevent domain mismatch errors.
Additional lines:
A Subject Alternative Name (SAN) certificate allows you to secure multiple domains and subdomains with a single SSL certificate. This is especially useful for businesses managing several related websites or services.
For multiple subdomains:
*.example.comThis covers:
Additional lines:
Wildcard certificates simplify SSL management by securing all first-level subdomains under a single domain. However, they do not protect the root domain unless it is explicitly included in the certificate.
Apache example:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.example\.com [NC]
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]Additional lines:
Choose either the www or non-www version of your website as the primary domain and redirect all traffic to it. Consistent redirects improve both SSL validation and search engine indexing.
Use:
openssl s_client -connect example.com:443This command displays:
Additional lines:
You can also use online SSL testing tools to verify that the correct certificate and intermediate certificates are installed. Checking the complete certificate chain helps identify configuration issues that browsers may flag.
If the certificate doesn’t cover the correct domains, generate a new certificate.
Let’s Encrypt example:
sudo certbot --apache -d example.com -d www.example.comAdditional lines:
After reissuing the certificate, restart your web server and confirm that the new certificate is being served correctly. It’s also a good idea to clear any CDN or server cache to ensure visitors receive the updated SSL certificate.
Common causes include:
WordPress Dashboard
→ Settings
→ General
Ensure both URLs match.
Verify SSL mode.
Recommended setting:
Full (Strict)Incorrect SSL modes frequently cause certificate mismatches.
Ensure:
Using:
localhostmay trigger certificate warnings because browsers don’t trust local certificates.
Several tools can help identify certificate issues.
|
Tool |
Purpose |
|
SSL Labs SSL Test |
SSL configuration analysis |
|
OpenSSL |
Certificate inspection |
|
Qualys SSL Checker |
SSL diagnostics |
|
Mozilla Observatory |
Security analysis |
|
Browser Developer Tools |
Certificate information |
Protect your website with expert SSL configuration and security solutions. Devstree helps businesses diagnose certificate issues, implement secure connections, and ensure reliable website performance for users and search engines.
Get Expert SSL SupportThe ERR_CERT_COMMON_NAME_INVALID error occurs when a website’s SSL certificate doesn’t match the domain name being accessed. Although it can be frustrating for users, the issue is usually caused by certificate misconfiguration, missing domain coverage, or incorrect server settings.
By installing the correct SSL certificate, including all necessary domain variations, configuring redirects properly, and regularly monitoring SSL health, website owners can eliminate this error and provide secure, trustworthy browsing experiences.
Partner with our experienced engineering team to turn your complex ideas into robust, high-performing applications.
Contact Us