x509: certificate is not valid for any names, but wanted to match api.example.com

The name after "wanted to match" is your dial target. For certificates without any SAN extension, Go instead says "x509: certificate relies on legacy Common Name field, use SANs instead" (when the CN would have matched).

Go crypto/x509 — HostnameError for a certificate with no DNS SANs (e.g. IP-only or empty SAN list)

What it means

Go tried to match the host name against the certificate and found no DNS names at all: the SAN extension exists but holds only IP addresses (or other entry types), and the Common Name is not considered. Go reports that the certificate covers no names, followed by the name it wanted.

Why it happens

• A certificate made for an IP address is used with a host name

  common

  Certificates generated for a node or VM address (IP SANs only), later reached through a DNS name.

• A certificate meant for something else

  occasional

  Client certificates, email (S/MIME) or code-signing certificates carry no DNS SANs and cannot serve as server certificates.

• The server presents the wrong certificate

  occasional

  A server configured with a client or internal certificate by mistake, often after a key rotation.

How to fix it

1. 1.

   Check the SAN entries and the purpose

   The SAN list shows which kinds of names exist; extendedKeyUsage shows whether it is a server certificate at all.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -subject -ext subjectAltName,extendedKeyUsage

2. 2.

   Issue a server certificate with DNS SANs

   Include the DNS names clients use, plus IP entries if they also connect by address.

   openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
     -addext "subjectAltName=DNS:api.example.com,IP:10.0.0.5"

3. 3.

   Or connect by the address the certificate names

   IP SANs match only when the client dials that IP.

   // If the certificate is meant for the IP address, dial the IP (it is matched against IP SANs)
   resp, err := client.Get("https://10.0.0.5:8443/")

← Browse the full signature error database