> Fix Firefox SSL_ERROR_BAD_CERT_DOMAIN: read the names the certificate covers, then fix the address, the server's certificate choice or the certificate. Source: https://pkizerotohero.com/errors/firefox-ssl-error-bad-cert-domain/ · Last reviewed: 2026-10-20 - Firefox - Exact text checked with the real tool # SSL\_ERROR\_BAD\_CERT\_DOMAIN Also seen in: Thunderbird, other NSS-based applications **In one sentence:** The site's certificate is trusted but not issued for the address you typed; Firefox lists the names it is valid for, which usually shows the problem at once. [Check yours: Hostname matcher](https://pkizerotohero.com/tools/hostname/) ## Where you see it As a full-page warning in Firefox. Recent versions title the page “Warning: Security Risk” and start with “Be careful. Something doesn’t look right.” Under **Advanced**, Firefox says which names the certificate covers: ```text The site is set up to allow only secure connections, but there’s a problem with the site’s certificate. It’s possible that a bad actor is trying to impersonate the site. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because its certificate isn’t valid for shop.example.com. The certificate is only valid for: *.hosting.example.net, hosting.example.net. ... Error Code: SSL_ERROR_BAD_CERT_DOMAIN ``` Older versions show “Warning: Potential Security Risk Ahead” and: “Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for shop.example.com. The certificate is only valid for …”. The texts are in Firefox’s [certificate error strings](https://searchfox.org/firefox-main/source/toolkit/locales/en-US/toolkit/neterror/certError.ftl). ## What it means A certificate lists the names it is valid for in its [Subject Alternative Name](https://pkizerotohero.com/handbook/glossary/#subject-alternative-name) (SAN) extension. Firefox trusts the certificate’s issuer, but the name in the address bar is not in that list. A genuine certificate for another site proves nothing about this one, so Firefox refuses it. The names after “only valid for” come straight from the certificate. Note If you are just visiting a website Check the address for typos. If the address is right, the site is misconfigured or the connection is being intercepted. Do not enter passwords or payment details; tell the site owner or your IT helpdesk which address you used. ## Likely causes ### The address is not in the certificate Read the “only valid for” list. Typical gaps: the certificate covers `www.example.com` but not `example.com`, a new subdomain was never added, or an internal site is reached by a short name such as `intranet`. To check from a terminal: ```bash openssl s_client -connect shop.example.com:443 -servername shop.example.com /dev/null | openssl x509 -noout -subject -ext subjectAltName ``` **Fix:** reissue the certificate with every name users type (with certbot: `certbot --nginx -d example.com -d www.example.com`; with a private CA: every name in `subjectAltName`), or redirect users to a name the certificate covers. ### The server sends another site’s certificate If the “only valid for” names belong to your hosting provider, CDN or another of your sites, the server did not find a certificate for your name and sent its default one. Servers choose the certificate using the name the browser sends in [SNI](https://pkizerotohero.com/handbook/glossary/#sni). Add the domain and its certificate to the hosting or CDN configuration, or give nginx a `server` block with `server_name shop.example.com;` and its own `ssl_certificate`. Check DNS as well: the name may point to an old server. ### A wildcard does not match `*.example.com` covers exactly one label. It matches `shop.example.com` but not `example.com` and not `eu.shop.example.com`. If the list shows only a wildcard, add the bare domain and any deeper names as separate SAN entries. ### The certificate has no usable SAN Older internal certificates sometimes carry the name only in the Common Name. Modern browsers match names against the SAN list, so reissue the certificate with a SAN: ```bash openssl req -new -key server.key -subj "/CN=intranet.example.com" \ -addext "subjectAltName=DNS:intranet.example.com" -out server.csr ``` ### You browse to an IP address `https://10.0.0.5/` matches only an IP entry in the SAN list. Use the DNS name, or have your private CA include the address as an `IP:` entry. Warning Proceeding is not a fix “Proceed to … (Risky)” stores an exception for a certificate that was made for another site, which is exactly what an attacker would present. Make the certificate and the address match instead. ## Check yours *Interactive tool: Hostname matcher (runs in the browser at [/tools/hostname/](https://pkizerotohero.com/tools/hostname/))* Paste the site’s certificate (**View the site’s certificate** on the warning page, then download the PEM file) and type the address you use. The matcher shows which SAN entries match and why the others do not. ## Learn why - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) - [The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/): SNI and default certificates. - Chrome’s version of this error: [NET::ERR\_CERT\_COMMON\_NAME\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-common-name-invalid/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/firefox-ssl-error-bad-cert-domain/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 9: Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) ## Everything on this topic - [Certificates](https://pkizerotohero.com/topics/certificates/)