Hostname mismatch: the certificate exists, but not for this name
2 min read
Seeing NET::ERR_CERT_COMMON_NAME_INVALID in Chrome or "hostname mismatch" in curl? How SAN coverage works, the www vs bare-domain trap, and the fix.
A valid certificate can still be for the wrong name
A certificate is valid only for the hostnames listed inside it. Browsers read that list from the SAN (Subject Alternative Name) field and have ignored the legacy CN field entirely since 2017. If the name you visit is not on the list, Chrome shows NET::ERR_CERT_COMMON_NAME_INVALID and curl reports hostname ... does not match.
The two most common cases: the certificate covers www.example.com but the visitor arrives at example.com (or vice versa) — to a certificate these are two different names; and a forgotten subdomain: api.example.com needs its own entry.
Diagnosis: what does it actually cover?
Query your domain in SSLx and click the "Domain matches / mismatch" badge: the dialog shows the queried name, the full list of covered names with the matching one highlighted, and the reason for a mismatch in plain language — e.g. "the certificate covers www but not the bare domain" — plus a "try querying" suggestion where one exists.
The fix
Reissue the certificate with every name you serve in the SAN list: at minimum example.com + www.example.com, plus subdomains or a *.example.com wildcard where appropriate. With certbot, pass multiple names as -d example.com -d www.example.com. Test both addresses separately afterwards.
Test your own site
SSLx performs every diagnosis in this guide in ten seconds: chain verification, hostname matching, expiry and HSTS — free, no signup.
Test with SSLxFrequently asked questions
The CN matches; why does the browser still reject it?
Browsers have looked only at the SAN list since 2017; the CN is ignored. A certificate without a SAN, or without the name in its SAN, is rejected regardless of the CN. SSLx flags this explicitly: "Only the CN matches — browsers will reject it."
How many hostnames can one certificate hold?
Limits vary by CA; Let's Encrypt allows 100 names per certificate. For many unrelated sites, separate certificates are easier to manage.