SSL_ERROR_BAD_CERT_DOMAIN

Where you see it

As a full-page warning in Firefox. Recent versions title the page “Warning: Security Risk” and start with “Be careful. Something doesn’t look right.” Under Advanced, Firefox says which names the certificate covers:

The site is set up to allow only secure connections, but there’s a problem with the site’s certificate. It’s possible that a bad actor is trying to impersonate the site. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because its certificate isn’t valid for shop.example.com. The certificate is only valid for: *.hosting.example.net, hosting.example.net.
...
Error Code: SSL_ERROR_BAD_CERT_DOMAIN

Older versions show “Warning: Potential Security Risk Ahead” and: “Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for shop.example.com. The certificate is only valid for …”. The texts are in Firefox’s certificate error strings.

What it means

A certificate lists the names it is valid for in its Subject Alternative Name (SAN) extension. Firefox trusts the certificate’s issuer, but the name in the address bar is not in that list. A genuine certificate for another site proves nothing about this one, so Firefox refuses it. The names after “only valid for” come straight from the certificate.

Likely causes

The address is not in the certificate

Read the “only valid for” list. Typical gaps: the certificate covers www.example.com but not example.com, a new subdomain was never added, or an internal site is reached by a short name such as intranet. To check from a terminal:

openssl s_client -connect shop.example.com:443 -servername shop.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Fix: reissue the certificate with every name users type (with certbot: certbot --nginx -d example.com -d www.example.com; with a private CA: every name in subjectAltName), or redirect users to a name the certificate covers.

The server sends another site’s certificate

If the “only valid for” names belong to your hosting provider, CDN or another of your sites, the server did not find a certificate for your name and sent its default one. Servers choose the certificate using the name the browser sends in SNI. Add the domain and its certificate to the hosting or CDN configuration, or give nginx a server block with server_name shop.example.com; and its own ssl_certificate. Check DNS as well: the name may point to an old server.

A wildcard does not match

*.example.com covers exactly one label. It matches shop.example.com but not example.com and not eu.shop.example.com. If the list shows only a wildcard, add the bare domain and any deeper names as separate SAN entries.

The certificate has no usable SAN

Older internal certificates sometimes carry the name only in the Common Name. Modern browsers match names against the SAN list, so reissue the certificate with a SAN:

openssl req -new -key server.key -subj "/CN=intranet.example.com" \
  -addext "subjectAltName=DNS:intranet.example.com" -out server.csr

You browse to an IP address

https://10.0.0.5/ matches only an IP entry in the SAN list. Use the DNS name, or have your private CA include the address as an IP: entry.

Check yours

Try it: Hostname matcherOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

What do you have?

A certificateA list of names

Paste the server's certificate

Try a sampleChoose a sample…A wildcard certificate (*.example.com)A website certificate (www.example.com)A certificate with a Common Name but no SAN

-----BEGIN CERTIFICATE----- MIIDkDCCAzagAwIBAgIQWMoxwkHd0IeKOVJbof+xFzAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGDEWMBQGA1UEAwwNKi5leGFtcGxlLmNvbTCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAKxCIh60qPF0ODk0Z3x6knBBykpImDplqqqn ITnmRvyt0Rnh1BDIvSfvFhkIltlduWbSs8ORd93AEg5YvlvtayYdkoIUcJFghQB4 k53309ULzJcRSZlJsixbKzt0jFHnTAfkmt7D9usTAsuZQx0Ak60gf9ccb+i1m+Zc /CUiCM69FZTaGL+GGLArLRvko71F0zhTjkEFTpFR/bOoP9MZvSTNpxNdeSFhnhqL Uhf4dOT3bes1pc/9O6WzzvVOUCzxb4Q/AghVmPJEKd2pWdCCwX4oG2HJcJ9/yodO jgw2evnJjiWLulVPj6isQRxZ5HPtTte8dP57kgaYO7s/xQcnScUCAwEAAaOCAS8w ggErMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsG AQUFBwMBMBgGA1UdEQQRMA+CDSouZXhhbXBsZS5jb20wHQYDVR0OBBYEFHhtIlz5 703vofxqWsGthT0RpsdCMB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/zOvSNjJqe MEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5leGFtcGxl LmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCgLoYsaHR0 cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmwwEwYDVR0g BAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSAAwRQIgPj6NTChaz1x1y8IKmStJ zQeNp1eq2qzumFC0Kf9NBykCIQC8CdKps/XAEzPQhDd7L6Vy7xZeQsy3Z39RSbcy M3PaoA== -----END CERTIFICATE-----

Choose a file

Host name you connect to

Paste the site’s certificate (View the site’s certificate on the warning page, then download the PEM file) and type the address you use. The matcher shows which SAN entries match and why the others do not.

Learn why

• Names and jobs: SANs, wildcards, key usage and the CA flag
• The TLS 1.3 handshake: SNI and default certificates.
• Chrome’s version of this error: NET::ERR_CERT_COMMON_NAME_INVALID.

In the gameLevel 9: Names and jobsName Registry, Keystone. In development