The certificate's owner does not match hostname 'api.example.com'

GnuTLS builds of wget print this line; OpenSSL builds print "ERROR: no certificate subject alternative name matches" followed by "requested host name '<host>'." on the next line. The host is the one from your URL.

What it means

The certificate verified, but it was issued for other names than the host in the URL, so wget stops. The host is compared with the DNS names in the certificate's Subject Alternative Name extension, which is where every current CA puts the names a certificate covers. wget exits with status 5.

Why it happens

• The certificate does not cover this name

  common

  A certificate for www.example.com does not cover example.com, api.example.com or a new subdomain; each name must be listed, and a wildcard covers only one label.

• The URL uses an IP address or an internal alias

  common

  Downloading from https://10.0.0.5/ or a container or host alias reaches the server but asks for a name that the certificate does not list.

• The server sent the certificate of another site

  occasional

  On shared hosting and ingress controllers, a name without its own server block gets the default certificate.

How to fix it

1. 1.

   List the names the certificate covers

   Compare the subjectAltName entries with the host in the URL.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Reissue the certificate with the missing name

   Add every hostname clients use to the certificate request, then deploy and reload.

   sudo certbot certonly --nginx -d example.com -d www.example.com -d api.example.com

3. 3.

   Use a name from the certificate

   If the server is reachable under a listed name, use that name in the URL instead of an IP address or alias.

   # Download through a name the certificate lists, not an IP or alias
   wget https://www.example.com/file.tar.gz

← Browse the full signature error database