Security & SSL
Certificate Hostname Mismatch
A certificate hostname mismatch occurs when the domain name in the browser doesn't match any of the names listed in the SSL certificate's Common Name (CN) or Subject Alternative Names (SAN). This triggers browser security warnings and prevents secure connections.
Symptoms
- ERR_CERT_COMMON_NAME_INVALID error in browsers
- SSL certificate warning showing wrong domain name
- Certificate works for www.example.com but not example.com (or vice versa)
- API clients rejecting the certificate due to hostname verification failure
Common Causes
- Certificate issued for wrong domain name
- Missing SAN entries for domain variations (www vs non-www)
- Wildcard certificate not covering the apex domain
- Server hosting multiple domains with wrong certificate being served (SNI issue)
- Domain recently changed but certificate not reissued
Step-by-Step Troubleshooting
- 1
Check certificate details
Inspect the CN and SAN fields to see which domains the certificate covers.
Use SSL Certificate Check → - 2
Verify DNS configuration
Confirm which domains and subdomains should be covered.
Use DNS Records Dump → - 3
Reissue certificate
Request a new certificate with all required domain names in the SAN field.
- 4
Verify SNI configuration
If hosting multiple domains, ensure the correct certificate is served for each domain based on SNI.
Recommended Diagnostic Tools
Monitor Certificate Names
Get alerts if certificate hostnames become mismatched.