invalid peer certificate: certificate not valid for name "api.example.com"; certificate is only valid for DnsName("www.example.com")

The expected name and the presented list are filled in per failure; IP addresses appear as IpAddress(…). Earlier rustls releases printed only the variant name ("invalid peer certificate: NotValidForName").

rustls 0.23 (via reqwest, ureq, hyper-rustls) — CertificateError::NotValidForNameContext

What it means

The chain is trusted, but the name the client connected to is not among the certificate's Subject Alternative Names. rustls 0.23 lists both: the expected name and every name the certificate presents (DnsName, IpAddress entries), which makes the mismatch obvious.

Why it happens

• The certificate does not cover this name

  common

  Another subdomain, the bare domain or a renamed service is missing from the SAN list; wildcards cover a single label.

• Connecting by IP or an internal alias

  common

  Service names (Kubernetes, docker-compose) or raw addresses that the certificate was never issued for.

• The server sent its default certificate

  occasional

  A proxy without configuration for the requested name serves another site's certificate.

How to fix it

1. 1.

   Compare the presented names with the URL

   The message already lists them; openssl confirms what the server sends.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Override the address, not the name

   reqwest's ClientBuilder::resolve pins a host name to a socket address, so verification still uses the certificate's name.

   // Keep the certificate's name in the URL and send the connection to a specific address
   let addr: std::net::SocketAddr = "10.0.0.5:443".parse()?;
   let client = reqwest::Client::builder().resolve("www.example.com", addr).build()?;
   let resp = client.get("https://www.example.com/health").send().await?;

3. 3.

   Reissue with every name in use

   Add the missing DNS names (or IP entries) to the certificate.

   openssl req -new -key server.key -out server.csr -subj "/CN=api.example.com" \
     -addext "subjectAltName=DNS:api.example.com,DNS:www.example.com"

← Browse the full signature error database