A certificate can be current and issued by a trusted authority yet fail for the address a visitor requested. A hostname mismatch means the presented certificate does not provide an acceptable identity match for that address. Buying another certificate without locating the serving endpoint can leave the same error in place.

This guide is for an operator with access to the site’s domain and hosting configuration. Preserve the browser’s exact error and requested hostname first. Browser wording may refer to a “common name”; use the actual certificate identity fields when investigating.

Compare the hostname with SAN coverage

Modern DNS hostname checks use the certificate’s Subject Alternative Name entries of type DNS name. Do not rely on the certificate’s descriptive label or Common Name field. RFC 9525 defines name matching and the scope of wildcard matching.

Using reserved example names, a certificate for demo.test does not automatically cover www.demo.test. A wildcard entry such as *.demo.test matches one subdomain level, such as shop.demo.test; it does not cover the bare demo.test or pay.shop.demo.test. These names illustrate matching only and are not public certificate targets.

Inspect the certificate the browser actually sees, and write the requested hostname and matching SAN entry side by side. If you cannot identify a valid match, decide whether the endpoint is presenting the wrong certificate or whether the intended certificate lacks a required name.

Trace the request to its intended endpoint

  1. Confirm that the public hostname belongs to this site and is meant to work.
  2. Compare current DNS routing with the intended hosting or CDN configuration, including IPv4 and IPv6 where used.
  3. Check that the exact custom hostname is attached to the correct site or virtual host.
  4. Check which certificate that endpoint selects for the hostname.
  5. Repeat for aliases and old names that redirect to the primary address.

On shared infrastructure, Server Name Indication, or SNI, helps select the certificate for the requested name. A diagnostic connection that omits it may observe a default certificate and confuse the investigation. A browser request to an IP address is also a different identity check from a request to the normal hostname.

An optional read-only OpenSSL check

If OpenSSL is installed, the following synthetic example connects to a named TLS endpoint and requests hostname and certificate verification. Replace every occurrence of demo.test with the same hostname on a site you manage. The reserved example will not normally resolve publicly. No files or configuration are changed.

openssl s_client -connect demo.test:443 -servername demo.test -verify_hostname demo.test -verify_return_error

Read the verification output; a connection opening is not a pass. Stop the interactive session with Ctrl+C when finished. The OpenSSL manual documents these options. OpenSSL’s trust configuration and checks can differ from a browser’s, so this is one diagnostic observation, not a complete browser compatibility result. Its verification documentation explains the configured trust context.

Fix the layer the evidence identifies

If DNS points to the wrong service, coordinate a routing correction with the domain owner. If the custom hostname is missing from the host or CDN, add it through that platform’s documented domain workflow. If the intended endpoint lacks coverage, arrange issuance and deployment for the required names.

An HTTPS redirect cannot repair a mismatch on its starting hostname: the browser must establish TLS before receiving the HTTP redirect. Keep the redirecting name covered. Chrome’s certificate error reference helps distinguish this symptom from date or authority errors.

Verify the repaired name and its neighbors

Recheck the original hostname in the browser and compare the newly served SAN coverage. Check aliases and any other endpoint implicated by the change. Record the specific correction and update your hostname inventory. If the name now matches but a trust error remains, continue with certificate chain troubleshooting rather than weakening validation.

Sources