SSL_ERROR_BAD_CERT_DOMAIN

Shown under "Advanced" as "Error code: SSL_ERROR_BAD_CERT_DOMAIN", together with "… uses an invalid security certificate. The certificate is only valid for the following names: …".

Firefox — "Warning: Potential Security Risk Ahead", the certificate is not valid for this name

What it means

The certificate is trusted and in date, but it was issued for other names than the one in the address bar. Firefox lists the names the certificate is valid for on the warning page. Typical: www vs. bare domain, a new subdomain, or a wildcard used two levels deep.

Why it happens

• The host is not listed in the certificate

  common

  A new subdomain or alias without a reissued certificate.

• A wildcard one level too shallow

  common

  *.example.com does not cover a.b.example.com or example.com.

• The server returned another site's certificate

  occasional

  Shared hosting or ingress without a configuration for this name.

How to fix it

1. 1.

   Compare the certificate's names with the address

   Firefox's warning shows them too; openssl prints the SAN list.

   echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Reissue with every name in use

   Include apex, www and every subdomain the site serves.

   sudo certbot certonly --nginx -d example.com -d www.example.com -d shop.example.com

← Browse the full signature error database