NET::ERR_CERT_COMMON_NAME_INVALID

Where you see it

As a full-page warning in Chrome, Edge and other Chromium browsers. The code is ERR_CERT_COMMON_NAME_INVALID (−200) in Chromium’s network error list. Despite the name, it is about every name check, not just the Common Name field.

Your connection is not private
Attackers might be trying to steal your information from shop.example.com (for example, passwords, messages, or credit cards). Learn more about this warning
NET::ERR_CERT_COMMON_NAME_INVALID

Under Advanced, Chrome names the certificate it received:

This server could not prove that it is shop.example.com; its security certificate is from *.hosting.example.net. This may be caused by a misconfiguration or an attacker intercepting your connection.

What it means

A certificate lists the names it is valid for in its Subject Alternative Name (SAN) extension. Chrome trusted the certificate’s issuer, but the name in the address bar is not on that list. A genuine certificate for another site proves nothing about this one, so Chrome stops. Chrome ignores the Common Name and requires the hostname in the Subject Alternative Name since Chrome 58 (April 2017).

Likely causes

The name is not in the certificate

Common cases: the certificate covers www.example.com but not example.com (or the other way round), a new subdomain was added without a new certificate, or users reach an internal site by a short name such as intranet. List the names in the certificate:

openssl s_client -connect shop.example.com:443 -servername shop.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN=www.example.com
X509v3 Subject Alternative Name: 
    DNS:www.example.com

Fix: reissue the certificate with every name users type. With certbot, list each name: certbot --nginx -d example.com -d www.example.com. For a private CA, add all names to subjectAltName in the request. Or redirect users to a name the certificate covers.

A wildcard does not match

*.example.com covers exactly one label: shop.example.com, but not example.com and not eu.shop.example.com. Add those names as separate SAN entries.

The server sends another site’s certificate

On shared hosting, CDNs and servers with many sites, the server picks the certificate by the name the browser sends in SNI. If your domain is not configured there, you get the default certificate, as in the example above (*.hosting.example.net). Compare:

openssl s_client -connect shop.example.com:443 -servername shop.example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

Fix: add the domain and its certificate to the hosting or CDN configuration; in nginx, a server block with server_name shop.example.com; and its own ssl_certificate; on IIS, a binding with the host name and “Require Server Name Indication”. Also check DNS: the name may still point to an old server.

The certificate has no SAN, only a Common Name

Older internal certificates and quick self-made ones often put the name only in the Common Name. Chrome rejects these with this error even when the Common Name matches exactly. Some libraries still accept them, which is why curl may work while Chrome fails. Reissue the certificate with a SAN list:

openssl req -new -key server.key -subj "/CN=intranet.example.com" \
  -addext "subjectAltName=DNS:intranet.example.com" -out server.csr

You browse to an IP address

https://10.0.0.5/ matches only an IP entry in the SAN list. Use the DNS name, or include the address as an IP: entry when your private CA issues the certificate.

Check yours

Try it: Hostname matcherOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

What do you have?

A certificateA list of names

Paste the server's certificate

Try a sampleChoose a sample…A wildcard certificate (*.example.com)A website certificate (www.example.com)A certificate with a Common Name but no SAN

-----BEGIN CERTIFICATE----- MIICrDCCAlOgAwIBAgIQGQsPZe4Vyz1e11j00likkjAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAE7VE4XZ3FmlRUbvu3z1CC9M8v7oZmJRKmZsOotzOp lfeMxd8JW9cYoRrMt4UOSVCS3uQy8IKBijbwJauD7szAWqOCARUwggERMAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0G A1UdDgQWBBQwAmhb4xDcGhT39+55TFwnYlii5zAfBgNVHSMEGDAWgBTfqYd+7+NE jdt6+hYP8zr0jYyanjBIBggrBgEFBQcBAQQ8MDowOAYIKwYBBQUHMAKGLGh0dHA6 Ly9wa2kuZXhhbXBsZS5jb20vc2FtcGxlLWlzc3VpbmctY2EuY3J0MD0GA1UdHwQ2 MDQwMqAwoC6GLGh0dHA6Ly9wa2kuZXhhbXBsZS5jb20vc2FtcGxlLWlzc3Vpbmct Y2EuY3JsMBMGA1UdIAQMMAowCAYGZ4EMAQIBMAoGCCqGSM49BAMCA0cAMEQCIGv+ w3+hJkH5dv+cw3ZNdTJYPcaFfuS12LZ49t2e4dIWAiAW4UEViEFIrDg0FQoU5mSK aoaU/0QPdNEXjpy5tsaeIQ== -----END CERTIFICATE-----

Choose a file

Host name you connect to

Paste the site’s certificate and type the address you use. The matcher lists the SAN entries, shows which one matches, and flags certificates that only have a Common Name.

Learn why

• Names and jobs: SANs, wildcards, key usage and the CA flag
• The TLS 1.3 handshake: SNI and how a server chooses its certificate.
• Chrome Status: removal of Common Name matching.
• Firefox’s version of this error: SSL_ERROR_BAD_CERT_DOMAIN.

In the gameLevel 9: Names and jobsName Registry, Keystone. In development