> Fix Node.js ERR_TLS_CERT_ALTNAME_INVALID: Hostname/IP does not match certificate's altnames. Compare the host with the SANs, then fix the name. Source: https://pkizerotohero.com/errors/node-err-tls-cert-altname-invalid/ · Last reviewed: 2026-10-20 - Node.js - Exact text checked with the real tool # ERR\_TLS\_CERT\_ALTNAME\_INVALID Also seen in: npm, yarn, axios, fetch (undici), Electron **In one sentence:** The certificate is trusted, but the hostname or IP address you connected to is not among the names in its Subject Alternative Name list. [Check yours: Hostname matcher](https://pkizerotohero.com/tools/hostname/) ## Where you see it In Node.js HTTPS clients (`https`, `fetch`, axios, got) and in npm, after the certificate chain was accepted. The code is listed in the [Node.js errors documentation](https://nodejs.org/api/errors.html#err_tls_cert_altname_invalid); the check is done by [`tls.checkServerIdentity()`](https://nodejs.org/api/tls.html#tlscheckserveridentityhostname-cert). ```text TypeError: fetch failed ... [cause]: Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: api.internal.example.com. is not in the cert's altnames: DNS:www.example.com ... code: 'ERR_TLS_CERT_ALTNAME_INVALID', reason: "Host: api.internal.example.com. is not in the cert's altnames: DNS:www.example.com", host: 'api.internal.example.com', ``` When you connect by IP address and the certificate has no IP entries, the message ends differently: ```text Hostname/IP does not match certificate's altnames: IP: 10.0.0.5 is not in the cert's list: ``` npm shows the same code: `npm error code ERR_TLS_CERT_ALTNAME_INVALID`. ## What it means A certificate lists the names it is valid for in its [Subject Alternative Name](https://pkizerotohero.com/handbook/glossary/#subject-alternative-name) (SAN) extension. Node.js compares the host you connected to with that list. The message shows both sides: your host after `Host:` and the certificate’s names after `altnames:`. The certificate is genuine but issued for other names, so Node.js refuses it. ## Likely causes ### You use a name the certificate does not list A short internal name, a load balancer’s DNS name, a container name such as `api` in Docker Compose, or `localhost`. The message already shows the certificate’s names; to see the full certificate: ```bash openssl s_client -connect api.internal.example.com:443 -servername api.internal.example.com /dev/null | openssl x509 -noout -subject -ext subjectAltName ``` **Fix:** use one of the listed names in your URL, or have the certificate reissued with every name clients use. For a private CA, put all names in the request: ```bash openssl req -new -key server.key -subj "/CN=api.internal.example.com" \ -addext "subjectAltName=DNS:api.internal.example.com,DNS:api" -out server.csr ``` ### You connect by IP address An IP address only matches an `IP Address:` entry in the SAN list. Use the DNS name, or reissue the certificate with an `IP:` entry. If you must connect to an IP but verify a name, set `servername` and keep the check: ```javascript https.get({ host: '10.0.0.5', servername: 'api.internal.example.com', path: '/' }) ``` Node.js then sends `api.internal.example.com` in SNI and checks the certificate against that name. ### The server sends the wrong certificate A server with several sites chooses the certificate by the name in [SNI](https://pkizerotohero.com/handbook/glossary/#sni) and falls back to a default one. If the `altnames` in the message belong to a different site, the server is not configured for your name. Compare: ```bash openssl s_client -connect api.internal.example.com:443 -servername api.internal.example.com /dev/null | openssl x509 -noout -ext subjectAltName ``` Add a matching `server_name` block in nginx, a `ServerName` virtual host in Apache, or a hostname binding in IIS, each with the right certificate. On Kubernetes, check that the Ingress `tls.hosts` list contains the name. ### A wildcard does not cover this name `*.example.com` matches exactly one label. It does not match `example.com` or `v2.api.example.com`. Add those names as separate SAN entries. ### The certificate has no DNS name in its SAN If the reason reads `Host: api.internal.example.com. is not cert's CN: www.example.com`, the certificate has no DNS name in its SAN list (no SAN at all, or only IP addresses), so Node.js fell back to the Common Name. Browsers and Go never do that. Reissue the certificate with every hostname as a DNS entry in the SAN list. Warning Do not override checkServerIdentity Replacing `checkServerIdentity` with a function that returns `undefined`, `rejectUnauthorized: false` or `NODE_TLS_REJECT_UNAUTHORIZED=0` all accept a certificate issued for any other site, which is exactly what an attacker would present. Fix the name, the SNI setting or the certificate. ## Check yours *Interactive tool: Hostname matcher (runs in the browser at [/tools/hostname/](https://pkizerotohero.com/tools/hostname/))* Paste the server’s certificate and type the hostname from your URL. The matcher shows which SAN entries match and why the others do not. ## Learn why - [Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) - [The TLS 1.3 handshake](https://pkizerotohero.com/handbook/tls-handshake/): where SNI fits. - Related: [Hostname mismatch in Python](https://pkizerotohero.com/errors/python-hostname-mismatch/), [SSL\_ERROR\_BAD\_CERT\_DOMAIN in Firefox](https://pkizerotohero.com/errors/firefox-ssl-error-bad-cert-domain/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/node-err-tls-cert-altname-invalid/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 9: Names and jobs: SANs, wildcards, key usage and the CA flag](https://pkizerotohero.com/handbook/names-and-key-usage/) ## Fix it step by step - [How to make Python, Node.js and npm trust a private CA](https://pkizerotohero.com/guides/trust-ca-python-node/) - [How to get a wildcard certificate with DNS-01](https://pkizerotohero.com/guides/wildcard-dns-01/) ## Everything on this topic - [Certificates](https://pkizerotohero.com/topics/certificates/)