How to Fix ERR_CERT_COMMON_NAME_INVALID in Chrome
Read what Chrome's Advanced line tells you, then fix the certificate, the server or the URL.
Updated
TL;DR
ERR_CERT_COMMON_NAME_INVALID means Chrome trusts the authority behind the site's certificate, but the certificate was issued for other addresses, not the one you opened. Chrome's warning names an address it does cover; the site's owner fixes it by reissuing the certificate with every address visitors use.
What ERR_CERT_COMMON_NAME_INVALID looks like in Chrome and code
Chrome rows come from its warning page and console. In Python only the Hostname mismatch ending belongs here; other CERTIFICATE_VERIFY_FAILED endings have their own page.
| Where | What you see |
|---|---|
| Chrome warning page (heading: Your connection is not private) | Attackers might be trying to steal your information from example.org (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID |
| Chrome, after clicking Advanced | This server could not prove that it is example.org; its security certificate is from www.example.org. |
| Chrome, after clicking Advanced, certificate without subjectAltName | This server could not prove that it is example.org; its security certificate does not specify Subject Alternative Names. |
| Chrome DevTools console, failed fetch() or subresource | Failed to load resource: net::ERR_CERT_COMMON_NAME_INVALID |
| curl 8.7 on macOS (LibreSSL 3.3.6) | curl: (60) SSL: no alternative certificate subject name matches target host name 'example.org' |
| Python 3.12 ssl module | ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'example.org'. (_ssl.c:1000) |
| Node.js 20 and 24 https | Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: example.org. is not in the cert's altnames: DNS:www.example.org |
Why this happens
The site sent a trusted certificate made out to a different hostname.
Chrome matches the address only against the certificate's subjectAltName list, never its common name. Usually that list lacks one form of the domain, or the server answered with a certificate meant for another of its sites.
Diagnose your ERR_CERT_COMMON_NAME_INVALID first
The first four checks need only Chrome; the last one needs a terminal.
Click Advanced; if the hostname after "its security certificate is from" is the site's www or bare form, the certificate lacks your exact address.
If that hostname belongs to an unrelated domain, such as a hosting company's, the server that answered has no certificate set up for this site.
On hotel or cafe Wi-Fi, if that hostname belongs to a router or the Wi-Fi provider, the network's sign-in page answered instead of the site.
Check the address; if it is an IP address or a one-word name like intranet, the certificate probably lists only full domain names.
Run openssl s_client -connect host:443 -servername host </dev/null | openssl x509 -noout -text; if no DNS: entry covers host, this certificate lacks that name.
Solutions ranked by effectiveness
Start with the certificate's names; the later fixes cover the wrong server answering and scripts using the wrong name.
- Most common fix
Put every hostname on the certificate
Applies when Advanced shows a sibling of your address, like another subdomain of the same site. Get a replacement certificate that lists every hostname in its subjectAltName, then install it.
Collect every hostname from your DNS zone, links and redirects, subdomains included.
With Certbot, run certbot --nginx and add one -d flag per hostname.
Reload the web server, then open each hostname again to confirm the warning is gone.
- Check next
Send the name to the right server
Applies when Advanced names an unrelated domain. A hosts-file line, a stale DNS record or a missing server block sent this address to a server without its certificate.
Remove lines naming the site from C:\Windows\System32\drivers\etc\hosts or /etc/hosts.
Site owners: update the DNS A record so it carries the current server's IP.
On nginx, add the address to server_name in the block that loads its certificate.
- For developers
Put a listed name in the URL
Applies when a script or tool calls https:// with an IP address or a short name, which certificates rarely list.
Copy a hostname from the certificate's DNS: entries into the URL.
Don't count on a Host header; curl and Python still check the URL's host.
Stop the ERR_CERT_COMMON_NAME_INVALID from coming back
Habits for site owners and developers that keep each address on the certificate and pointed at the right server.
Keep the bare domain on the certificate even if it only redirects; hostnames are checked before any redirect.
When you renew with certbot certonly -d, list every hostname; a subset creates a separate, smaller certificate.
Schedule a script that opens every listed hostname with verification on and alerts when one fails.
Try a new server by IP with curl --resolve, as our Cloudflare 1003 guide shows, not a hosts-file edit.
Related errors
Learn more
FAQ
Targeting options in one call
Geonode's API lists the countries, states, cities and ASNs each proxy service can target.
