How to fix ERR_CERT_COMMON_NAME_INVALID
ERR_CERT_COMMON_NAME_INVALID (Chrome shows NET::ERR_CERT_COMMON_NAME_INVALID) means the certificate is otherwise valid, but the hostname you visited is not in its list of covered names. Browsers read the Subject Alternative Name list, not the old Common Name field, so a certificate that omits the exact host you used fails here.
- Likely cause
- The visited hostname is not in the certificate’s SAN list
- Severity
- High — the host shows a full trust warning
- Time to fix
- About 15 minutes, including reissue
- Prevention
- Include every served hostname in the SAN list
What causes it
- The certificate covers example.com but not www.example.com, or the reverse, so one of the two fails.
- A wildcard covers one label only, so a deeper subdomain such as a.b.example.com is not matched.
- A load balancer or CDN is serving the wrong tenant’s certificate for this hostname.
How to fix it
1. List the names the certificate actually covers
Read the SAN list from the served certificate. If the host you visited is not in it, that is the whole problem.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"2. Reissue for every hostname you serve
Request one certificate that lists every name, passing each with -d. certbot needs an authenticator, so name the plugin for your server (here, nginx).
sudo certbot certonly --nginx -d example.com -d www.example.com3. Install, reload, and re-check each hostname
Deploy the new certificate, reload the server, and test every hostname, including www and any subdomains you serve.
sudo systemctl reload nginx
How to prevent it
Keep the SAN list in sync with the hostnames you actually serve, and re-check each one after issuance, because a dropped www entry breaks half your traffic silently.
Source: RFC 6125 (hostname verification)
Common questions
Does the Common Name field still count?
No. Browsers stopped reading the Common Name for hostname matching years ago. Only the Subject Alternative Name list decides which hostnames a certificate covers.
My wildcard should cover this subdomain. Why the error?
A wildcard matches exactly one label. *.example.com covers app.example.com but not a.b.example.com, and it does not cover the bare example.com unless that is listed too.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.