no alternative certificate subject name matches target host name SSL / TLS Origin: Network OSI layer 6 · Presentation Last updated 4 Nov 2026

curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

The certificate's names (SANs) don't include the host curl connected to.

Exact message you may see no alternative certificate subject name matches target host namecurl: (51) SSL: no alternative certificate subject name matches target host namecurl: (51) SSL: certificate subject name does not match target host nameSSL: certificate subject name 'x' does not match target host name
Explore the map of this error Full error map →
Seen on: SSL Linux

Meaning

Connect with a hostname that is covered by the certificate, or reissue the certificate with the right SANs. Using an IP address fails unless the cert has an IP SAN. Use --resolve host:443:IP to test a specific server with the correct hostname instead of using the IP directly.

Common causes

  • Connecting via IP address
  • Certificate lacks the hostname in SAN
  • DNS pointing at the wrong server
  • Default vhost serving another certificate
  • www vs non-www mismatch

⚡ Quick fix

  1. curl --resolve example.com:443:203.0.113.5 https://example.com
  2. Reissue the certificate with all hostnames
  3. Fix DNS and the vhost server_name

Detailed fix by platform

Linux

  1. curl -vI --resolve example.com:443:203.0.113.5 https://example.com

How to diagnose

  1. Host — Name used?
  2. SAN — Contains it?
  3. Server — Right vhost?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…CRYPT_E_NO_REVOCATION_CHECK — curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate (SSL / TLS)CRYPT_E_NO_REVOCATION…curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL certif…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certifi…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMON_…No subject alternative names present — Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found (SSL / TLS)No subject alternativ…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_DO…wildcard certificate does not cover a.b.example.com — Browser: *.example.com certificate does not match a.b.example.com (ERR_CERT_COMMON_NAME_INVALID) (SSL / TLS)wildcard certificate …no altern…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.