Fixing "NET::ERR_CERT_COMMON_NAME_INVALID"

The browser blocks the page with:

Your connection is not private
NET::ERR_CERT_COMMON_NAME_INVALID

The certificate itself is trusted and unexpired — but the name you asked for isn't in its Subject Alternative Name (SAN) list. Modern browsers ignore the legacy Common Name entirely; if the hostname isn't a SAN, it's a mismatch.

Why it happens

Common causes: you visited the apex (example.com) but the cert only covers www.example.com; a wildcard*.example.com that doesn't match the apex or a two-level subdomain; the wrong virtual host served a different site's certificate; or a CDN/load-balancer default certificate is being presented.

Diagnose it

The HTTPS inspection below lists every name the served certificate covers, its issuer, and the full chain. Compare the exact hostname in the address bar against the SAN list — if it's absent, that's the mismatch.

Fix it

1. Reissue the certificate with every hostname you serve in the SAN list (apex and www).

2. For wildcards, remember *.example.com covers one label only — not the apex, not a.b.example.com.

3. Check the server block/vhost actually references the right certificate file for this hostname.

4. On a CDN, bind your custom certificate to the hostname instead of the provider's default.