NET::ERR_CERT_COMMON_NAME_INVALID, what it means and how to fix it

A certificate lists exactly which hostnames it is valid for. This error means the address in your address bar is not on that list: the certificate was issued for a different name. The classic case is a site whose certificate covers the bare domain but not www (or the reverse). Less benignly, it is also what an intercepting hotspot or a wrong DNS answer looks like, so context matters.

The fix, in order

  1. Check the address for a typo and try the other variant. If www.example.com fails, try example.com, and vice versa. Sites that misconfigure one variant usually serve a correct certificate on the other.
  2. If you are on public Wi-Fi, join the network properly first. Captive portals intercept the first connection and present their own certificate, which never matches. Open the portal's sign-in page, complete it, and reload the real site.
  3. View the certificate to see which names it does cover. The certificate viewer's subject alternative names show what the certificate is actually for. If it names a completely unrelated domain or a hotspot provider, you are being intercepted or misdirected; stop and change networks.
  4. Try the site on mobile data. If it loads cleanly there, the network you were on (its DNS or its portal) was presenting the wrong certificate. If it fails everywhere, the site's certificate is misconfigured and only the operator can reissue it for the right names.
A name mismatch on a site you use for banking, email, or work is a stop sign, not a nuisance. Do not proceed past the warning on a network you do not control; a mismatched certificate is exactly what a man-in-the-middle attack looks like from the browser's chair. Switch networks and try again there.

If it still happens

For site operators: issue the certificate for every hostname the site answers on (bare domain and www, plus any subdomains served), or use a wildcard or multi-name certificate, and confirm the server presents the right certificate for each name (SNI). Visitors cannot patch a name list that omits them.

Common questions

What name is the certificate supposed to match? The exact hostname in the address bar. Certificates list valid names in their Subject Alternative Name field; modern Chrome ignores the old Common Name field entirely, so a certificate whose SAN list omits the visited hostname fails even if its CN looks right.

Can DNS cause a name mismatch error? Yes. If DNS points the name at the wrong server (a stale record, a hijacked resolver, a hotel portal), the server that answers presents its own certificate for its own names. The browser is reporting accurately that whoever answered is not provably the site.

Related errors

ERR_CERT_DATE_INVALID · ERR_CERT_AUTHORITY_INVALID · ERR_CERT_REVOKED