NET::ERR_CERT_COMMON_NAME_INVALID SSL / TLS Origin: Network Last updated 13 Oct 2026

NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)

The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for example.com, or hitting the wrong virtual host.

Exact message you may see certificate is not valid forThis server could not prove that it is
Explore the map of this error Full error map →
Seen on: OpenSSL

Meaning

Browsers check the certificate’s Subject Alternative Names. Missing www/subdomains, default vhost certificates being served (SNI misconfiguration), or IP-based access cause this.

Common causes

  • Certificate lacks the hostname (www, subdomain)
  • Server serves the default vhost’s certificate (SNI/vhost config)
  • Visiting by IP or internal name
  • CDN/hosting custom domain not added

⚡ Quick fix

  1. Reissue the certificate including all names (-d example.com -d www.example.com)
  2. Fix the vhost server_name/ServerName for this host
  3. Redirect alternate names to a covered host

Detailed fix by platform

Shell

  1. openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

How to diagnose

  1. SAN — Names in the certificate
  2. Vhost — Which server block answers
  3. Host — Exact hostname used

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

526 — Cloudflare Error 526: Invalid SSL Certificate (Cloudflare)526Challenge failed for domain — Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404 (SSL / TLS)Challenge failed for …doesn't include signing certificate — Provisioning profile "x" doesn't include signing certificate "Apple Development: Name (ID)" (iOS)doesn't include signi…ERR_CERT_AUTHORITY_INVALID — NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private) (JavaScript)ERR_CERT_AUTHORITY_IN…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_CI…ERR_TLS_CERT_ALTNAME_INVALID — Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames (Node.js)ERR_TLS_CERT_ALTNAME_…NET::ERR_CERT_REVOKED — Chrome: Your connection is not private — NET::ERR_CERT_REVOKED (the certificate was revoked) (Browser)NET::ERR_CERT_REVOKEDno start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start lineNET::ERR_…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.