NET::ERR_CERT_COMMON_NAME_INVALID: Meaning & How to Fix It

What Does NET::ERR_CERT_COMMON_NAME_INVALID Mean?

An HTTPS certificate lists the names it is valid for, such as example.com and www.example.com. When you open a site, your browser checks that the name in the address bar is on that list. If it isn't, Chrome, Edge and other Chromium browsers stop with NET::ERR_CERT_COMMON_NAME_INVALID.

Chromium's source code defines it as error -200: "The server responded with a certificate whose common name did not match the host name." (Chromium)

The name is older than the check. Chrome now looks only at the certificate's Subject Alternative Names (SANs): it removed the fallback to the certificate's common name in Chrome 58, noting that RFC 2818 had deprecated it back in 2000. (Chrome Platform Status) The current standard, RFC 9525, says the same: the server identity "can only be expressed in the subjectAltNames extension".

How It Looks in Each Browser

Both browsers tell you which names the certificate does cover, which is the fastest clue to the cause.

Why It Happens: Chromium's Four Reasons

Chromium's source lists four ways this error comes about. (Chromium) In plain words:

• An attacker redirected your traffic to their own server, with a certificate for a name they control. This is why the warning exists.
• The server is misconfigured and sends the wrong certificate. A server that hosts many sites picks the certificate by the name your browser asks for (Server Name Indication, made for "servers that host multiple 'virtual' servers at a single underlying network address", RFC 6066). A site that has no certificate set up there gets another site's, or the server's default one.
• You're on Wi-Fi that wants you to sign in first. The network sends you to its login page, whose certificate can't match the site you asked for.
• Your device added a DNS search suffix. You typed a short name like intranet, the system tried intranet.corp.example, and the server's certificate doesn't cover the short name in your address bar.

A fifth cause is close to the second: a DNS service that blocks the site (an ISP block, parental controls, an ad-blocking DNS) can send you to a block page with its own certificate. Our guide to "Your connection is not private" covers that case.

Check Which Names the Certificate Covers

To see the certificate the site really sends, check it from outside your device and network. Enter the address below: the check lists every name on the certificate and says whether the one you typed matches.

Whether a name matches follows fixed rules. Every name has to be listed on its own, and a wildcard is allowed only as "the complete content of the left-most label" and "can only match one label". (RFC 9525)

How to Fix It as a Visitor

Try these in order, and reload the page after each one.

1. Check the addressLook for a typo, and try the site with and without www. Open it from a search result or a link you trust rather than an old bookmark.
2. Sign in to the Wi-FiOn hotel, airport or café Wi-Fi, open a plain http:// page such as http://neverssl.com. The network's login page appears; after you sign in, reload the site.
3. Type the full name on a work networkInstead of a short name like intranet, type the full one, such as intranet.corp.example, so the name in the address bar is the one on the certificate.
4. Turn off a filtering DNS, VPN or proxy to testIf the certificate turns out to belong to a filter or a network appliance, the block is on your side, not the site's.
5. If only this site fails everywhere, tell its ownerWhen the SSL Checker above shows the same mismatch, nothing on your device can fix it: the site has to put the right name on its certificate.

If You Run the Website

Visitors see this error when your certificate doesn't list the name they used. To fix it:

• Put every name on the certificate, both example.com and www.example.com, plus each subdomain you serve. A wildcard (*.example.com) covers one level of subdomains and never the bare domain, so list example.com next to it.
• Make sure each name gets its own certificate from the server. On shared hosting, a load balancer or a CDN, add the name to the site's configuration there, not only to DNS: otherwise it gets the default certificate.
• Don't rely on the Common Name. Browsers check only the Subject Alternative Names; a name that appears only in the CN doesn't count.
• Reissue after adding a name. A certificate can't be edited: request a new one with the full list. Our CSR Generator builds the request with every name in it.

Then check the live site with the SSL Checker, or paste the certificate into the Certificate Decoder to read its names. The other two common certificate errors have their own guides: ERR_CERT_DATE_INVALID for dates and ERR_CERT_AUTHORITY_INVALID for trust.