SSL_ERROR_BAD_CERT_DOMAIN SSL / TLS Origin: Network Last updated 4 Nov 2026

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

Exact message you may see Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid forThe certificate is only valid for the following namesError code: SSL_ERROR_BAD_CERT_DOMAIN
Explore the map of this error Full error map →
Seen on: SSL

Meaning

Compare the name in the address bar with the certificate's SAN list. A cert for example.com doesn't cover www.example.com unless it lists it. Typical on shared hosting default certificates, new subdomains without a certificate, or when DNS points to the wrong server.

Common causes

  • Subdomain not included in the certificate
  • DNS pointing to a different server with another certificate
  • Default virtual host serving the wrong cert (SNI missing)
  • Wildcard used at the wrong level
  • Domain changed but certificate not reissued

⚡ Quick fix

  1. Reissue the certificate with all required names (SANs)
  2. Verify DNS points to the intended server
  3. Configure a matching server_name / ServerName

Detailed fix by platform

Linux

  1. openssl s_client -connect host:443 -servername host </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

How to diagnose

  1. SAN — Contains the host?
  2. DNS — Correct server?
  3. SNI — Correct vhost?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not establish t…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMON_…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative certif…No subject alternative names present — Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found (SSL / TLS)No subject alternativ…SEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_CER…SSL_ERROR_RX_RECORD_TOO_LONG — Firefox: Secure Connection Failed — SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG (SSL / TLS)SSL_ERROR_RX_RECORD_T…tlsv1 unrecognized name (SNI) — OpenSSL: SSL alert number 112 — tlsv1 unrecognized name (SSL / TLS)tlsv1 unrecognized na…SSL_ERROR…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.