# NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)

**Code:** `NET::ERR_CERT_COMMON_NAME_INVALID` · **Category:** SSL / TLS · **Seen on:** OpenSSL

The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for example.com, or hitting the wrong virtual host.

## Meaning

Browsers check the certificate’s Subject Alternative Names. Missing www/subdomains, default vhost certificates being served (SNI misconfiguration), or IP-based access cause this.

## Common causes

- Certificate lacks the hostname (www, subdomain)
- Server serves the default vhost’s certificate (SNI/vhost config)
- Visiting by IP or internal name
- CDN/hosting custom domain not added

## Quick fix

1. Reissue the certificate including all names (-d example.com -d www.example.com)
2. Fix the vhost server_name/ServerName for this host
3. Redirect alternate names to a covered host

## Detailed fix by platform

### Shell

1. `openssl s_client -connect example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName`

## How to diagnose

1. **SAN** — Names in the certificate
2. **Vhost** — Which server block answers
3. **Host** — Exact hostname used

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/err-cert-common-name-invalid)