NET::ERR_CERT_COMMON_NAME_INVALID: Causes and Fix

The short answer

NET::ERR_CERT_COMMON_NAME_INVALID appears when the hostname in the address bar is not listed in the website’s SSL certificate. The certificate may be valid and trusted, but it was issued for a different name, for example example.com instead of www.example.com or shop.example.com.

In other words, the server presents an SSL certificate with the wrong hostname. The fix is on the server side: install a certificate that includes the exact name, or make sure the server sends the right certificate for that name.

What does ERR_CERT_COMMON_NAME_INVALID mean?

It means the hostname you visited is not in the certificate’s list of subject alternative names (SANs), the field where a certificate names every domain it is valid for. Chrome compares the hostname against that list and stops the connection when there is no match.

Despite its name, the error is not about the common name (CN) field. Chrome has ignored the common name for this check since Chrome 58 in 2017 and looks only at the SAN list. Other browsers show similar name-mismatch warnings with their own error codes.

Cause	Example	Fix
www or non-www missing	Certificate for example.com, visitor opens www.example.com	Certificate covering both forms
Subdomain not covered	blog.example.com not in the SAN list	Add a SAN or use a wildcard
Wildcard one level too deep	*.example.com used for a.b.example.com	Add the name as a SAN or a second-level wildcard
Wrong certificate served	Shared server sends the default site’s certificate	Fix the virtual host or SNI configuration
CDN or proxy certificate	Proxy presents a certificate without your custom domain	Add the domain to the CDN’s certificate settings
Interception software	Antivirus or company proxy replaces certificates	Visitor-side: check that software

When the right certificate exists but the wrong one appears

On servers that host several sites, the server picks a certificate by the name the browser sends at the start of the connection (SNI, Server Name Indication). If a hostname has no matching configuration, the server falls back to its default certificate, which belongs to another site. The same happens when a CDN or load balancer handles HTTPS without your custom domain set up.

How do I fix it for www vs non-www?

Use a certificate that lists both example.com and www.example.com, then redirect one form to the other. A redirect alone does not help, because the browser checks the certificate before it follows any redirect.

Many single-domain certificates include both forms automatically, but this depends on the certificate authority (CA) and product, so check the product details or the SAN list after issuance. If you entered only one form when ordering, a reissue with both names usually solves it within your current term.

Tip: Test the bare domain, the www form and both with http:// typed explicitly. Visitors, old links and search results use all four.

Why does it appear on a subdomain?

It appears on a subdomain when that exact subdomain is not in the certificate, or when a wildcard does not reach it. A wildcard certificate for *.example.com covers one subdomain level only.

Hostname	Covered by *.example.com?
shop.example.com	Yes
www.example.com	Yes
example.com	Usually included, depending on the CA
eu.shop.example.com	No – needs its own SAN or *.shop.example.com
example.net	No – different domain

Plan the names before you order. List every hostname that serves HTTPS today, including publicly reachable mail, API and staging hosts, and decide which ones a wildcard reaches.

If you are unsure how the asterisk matching works, read our explainer on what a wildcard certificate is. For many first-level subdomains, wildcard SSL certificates are the simplest fix. For a handful of unrelated names, or for deeper subdomains, add them as SANs on a multi-domain (SAN) SSL certificate.

Is it the visitor’s or the site owner’s problem?

In almost every case it is the site owner’s problem: the server presents a certificate that does not include the requested name, and only the site owner can change that. Clearing the browser cache or changing the clock will not help.

The exception is software that intercepts HTTPS on the visitor’s device or network, such as antivirus web scanning, parental controls or a corporate proxy. If one visitor sees this error on many unrelated sites while others do not, that software is the likely cause. To check the certificate from outside any single device or network, run the hostname through our SSL checker. For other warning types, see our overview of SSL certificate errors.