> Fix NET::ERR_CERT_COMMON_NAME_INVALID in Chrome and Edge: compare the address with the certificate's SANs, then fix the name, server or certificate. Source: https://pkizerotohero.com/errors/chrome-err-cert-common-name-invalid/ · Last reviewed: 2026-10-20 - Chrome - Exact text checked with the real tool # NET::ERR\_CERT\_COMMON\_NAME\_INVALID Also seen in: Edge, Brave, Opera, Electron apps, Android WebView **In one sentence:** The certificate is trusted but not issued for this address: the name is missing from its SAN list, the server sent another site's certificate, or it has no SAN. [Check yours: Hostname matcher](https://pkizerotohero.com/tools/hostname/) ## Where you see it As a full-page warning in Chrome, Edge and other Chromium browsers. The code is `ERR_CERT_COMMON_NAME_INVALID` (−200) in Chromium’s [network error list](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h). Despite the name, it is about every name check, not just the Common Name field. ```text Your connection is not private Attackers might be trying to steal your information from shop.example.com (for example, passwords, messages, or credit cards). Learn more about this warning NET::ERR_CERT_COMMON_NAME_INVALID ``` Under **Advanced**, Chrome names the certificate it received: ```text This server could not prove that it is shop.example.com; its security certificate is from *.hosting.example.net. This may be caused by a misconfiguration or an attacker intercepting your connection. ``` ## What it means A certificate lists the names it is valid for in its [Subject Alternative Name](https://pkizerotohero.com/handbook/glossary/#subject-alternative-name) (SAN) extension. Chrome trusted the certificate’s issuer, but the name in the address bar is not on that list. A genuine certificate for another site proves nothing about this one, so Chrome stops. Chrome ignores the Common Name and requires the hostname in the Subject Alternative Name since Chrome 58 (April 2017). Note If you are just visiting a website Check the address for typos first. If the address is right, the site has a configuration problem, or the connection is being intercepted. Do not enter passwords or card details. If it is a company site, tell your IT helpdesk which address you used. ## Likely causes ### The name is not in the certificate Common cases: the certificate covers `www.example.com` but not `example.com` (or the other way round), a new subdomain was added without a new certificate, or users reach an internal site by a short name such as `intranet`. List the names in the certificate: ```bash openssl s_client -connect shop.example.com:443 -servername shop.example.com /dev/null | openssl x509 -noout -subject -ext subjectAltName ``` ```text subject=CN=www.example.com X509v3 Subject Alternative Name: DNS:www.example.com ``` **Fix:** reissue the certificate with every name users type. With certbot, list each name: `certbot --nginx -d example.com -d www.example.com`. For a private CA, add all names to `subjectAltName` in the request. Or redirect users to a name the certificate covers. ### A wildcard does not match `*.example.com` covers exactly one label: `shop.example.com`, but not `example.com` and not `eu.shop.example.com`. Add those names as separate SAN entries. ### The server sends another site’s certificate On shared hosting, CDNs and servers with many sites, the server picks the certificate by the name the browser sends in [SNI](https://pkizerotohero.com/handbook/glossary/#sni). If your domain is not configured there, you get the default certificate, as in the example above (`*.hosting.example.net`). Compare: ```bash openssl s_client -connect shop.example.com:443 -servername shop.example.com /dev/null | openssl x509 -noout -ext subjectAltName ``` **Fix:** add the domain and its certificate to the hosting or CDN configuration; in nginx, a `server` block with `server_name shop.example.com;` and its own `ssl_certificate`; on IIS, a binding with the host name and “Require Server Name Indication”. Also check DNS: the name may still point to an old server. ### The certificate has no SAN, only a Common Name Older internal certificates and quick self-made ones often put the name only in the Common Name. Chrome rejects these with this error even when the Common Name matches exactly. Some libraries still accept them, which is why `curl` may work while Chrome fails. Reissue the certificate with a SAN list: ```bash openssl req -new -key server.key -subj "/CN=intranet.example.com" \ -addext "subjectAltName=DNS:intranet.example.com" -out server.csr ``` ### You browse to an IP address `https://10.0.0.5/` matches only an IP entry in the SAN list. Use the DNS name, or include the address as an `IP:` entry when your private CA issues the certificate. Warning Proceeding is not a fix “Proceed to … (unsafe)” accepts a certificate that was made for another site. That is exactly what an attacker would present. Fix the certificate or the server’s configuration so the names match. ## Check yours *Interactive tool: Hostname matcher (runs in the browser at [/tools/hostname/](https://pkizerotohero.com/tools/hostname/))* Paste the site’s certificate and type the address you use. The matcher lists the SAN entries, shows which one matches, and flags certificates that only have a Common Name. ## Learn why - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) - [The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/): SNI and how a server chooses its certificate. - Chrome Status: [removal of Common Name matching](https://chromestatus.com/feature/4981025180483584). - Firefox’s version of this error: [SSL\_ERROR\_BAD\_CERT\_DOMAIN](https://pkizerotohero.com/errors/firefox-ssl-error-bad-cert-domain/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/chrome-err-cert-common-name-invalid/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 9: Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) ## Fix it step by step - [How to inspect a certificate with OpenSSL](https://pkizerotohero.com/guides/inspect-certificate-openssl/) - [How to create a key and a CSR with OpenSSL (with SANs)](https://pkizerotohero.com/guides/create-csr-openssl/) - [How to create a CSR on Windows (certreq and IIS)](https://pkizerotohero.com/guides/create-csr-windows/) - [How to install a certificate in nginx](https://pkizerotohero.com/guides/install-certificate-nginx/) - [How to install a certificate in Apache httpd](https://pkizerotohero.com/guides/install-certificate-apache/) - [How to install a certificate in IIS](https://pkizerotohero.com/guides/install-certificate-iis/) - [How to get a wildcard certificate with DNS-01](https://pkizerotohero.com/guides/wildcard-dns-01/) ## Everything on this topic - [Certificates](https://pkizerotohero.com/topics/certificates/)