net::ERR_CERT_COMMON_NAME_INVALID

The interstitial shows "NET::ERR_CERT_COMMON_NAME_INVALID"; automation tools print "net::ERR_CERT_COMMON_NAME_INVALID".

Chrome, Edge and other Chromium browsers — the certificate does not cover the host name in the address bar

What it means

The certificate is trusted and in date, but the host name in the address bar is not among its Subject Alternative Names. Despite the name, Chrome does not use the Common Name at all (since Chrome 58); the certificate must list the host in subjectAltName. Typical: www vs. bare domain, a new subdomain, or a wildcard used one level too deep.

Why it happens

• The certificate does not list this host

  common

  A subdomain or alias added in DNS without reissuing the certificate.

• A wildcard used for two levels

  common

  *.example.com covers shop.example.com but not eu.shop.example.com (as on wrong.host.badssl.com in the reproduction).

• www and the bare domain

  common

  A certificate for www.example.com does not cover example.com, and vice versa; both must be listed.

• The name is only in the Common Name

  occasional

  Certificates without subjectAltName (old internal tools) fail in Chrome even when the CN matches.

How to fix it

1. 1.

   Compare the SAN list with the address

   The missing name is the one to add.

   echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Reissue with every name you serve

   Include apex, www and all subdomains (or a wildcard per level).

   # Cover the apex and www (and any subdomain you serve)
   sudo certbot certonly --nginx -d example.com -d www.example.com

3. 3.

   Check which certificate each name gets

   On shared servers, a name without its own server block receives the default certificate of another site.

   # nginx: every served name needs a server block with a matching certificate
   server {
       listen 443 ssl;
       server_name example.com www.example.com;
       ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
   }

← Browse the full signature error database