When a browser shows "err cert common name invalid," it means the SSL certificate does not match the domain being visited. This mismatch often blocks access until the certificate or the URL is corrected.
Below is a structured overview of how this error appears, why it happens, and how operations teams typically respond.
| Error Name | Typical Cause | Common Impact | First Check |
|---|---|---|---|
| ERR_CERT_COMMON_NAME_INVALID | Certificate domain does not match requested hostname | Site blocked in browser for security | Browser console and certificate details |
| Chrome, Firefox, Edge behavior | Strict hostname validation rules | Users see security warnings or blank pages | Incognito test and timestamp verification |
| Server configuration | |||
| Load balancer or CDN settings | Wrong certificate served or SNI mismatch | Error appears only on specific hostnames | Check SNI forwarding and virtual host setup |
Diagnostic Steps for ERR_CERT_COMMON_NAME_INVALID
Check the Certificate Hostname
Review the certificate subject and Subject Alternative Names (SAN) to ensure they include the exact hostname used in the browser.
Verify Server Configuration
Confirm the server is presenting the correct certificate for the requested domain, especially when multiple sites share an IP address.
Load Balancer and CDN Misconfigurations
SNI and Virtual Hosting
Modern environments often rely on Server Name Indication (SNI). If the load balancer or CDN does not forward SNI correctly, the wrong certificate can be served.
Edge Certificate Deployment
When using a CDN, ensure the origin certificate matches the edge configuration and that custom domain mappings are consistent.
Certificate Authority and Validation Rules
Wildcard and Exact Hostname Matching
Browsers treat wildcards like *.example.com as valid only for one level of subdomain. Requests to deeper hosts or non-matching patterns can trigger ERR_CERT_COMMON_NAME_INVALID.
SAN Coverage
Modern best practice is to rely on SAN fields rather than the legacy Common Name (CN). Missing SAN entries are a frequent cause of hostname mismatches.
Remediation and Prevention
- Verify that the certificate SAN list includes all hostnames and subdomains used by users.
- Test configurations in staging before promoting to production.
- Use tools that simulate browser validation to catch mismatches early.
- Monitor certificate expiration and renewal to avoid service disruption.
- Document certificate mappings for load balancers, CDNs, and virtual hosts.
FAQ
Reader questions
Why does the error appear only in one browser and not another?
Browsers enforce different validation policies and certificate transparency requirements, so a mismatch flagged in one may be ignored or handled differently in another.
Can an expired certificate cause ERR_CERT_COMMON_NAME_INVALID?
Yes, some browsers treat expired certificates as invalid and display a hostname mismatch error instead of an expiration warning.
Does this error indicate a security threat?
It often signals accidental misconfiguration, but it can also be caused by an attacker presenting an incorrect certificate for the domain.
How quickly should this issue be fixed in production?
Production services should resolve the mismatch immediately to restore user access and maintain trust in the security posture.