SSL_ERROR_BAD_CERT_DOMAIN: a certificate issued for another address

What this error means

A certificate contains a list of names (addresses) it is valid for. Firefox shows SSL_ERROR_BAD_CERT_DOMAIN when the address in your browser bar is not on that list. The warning heading is “Be careful. Something doesn’t look right.” (in older versions “Warning: Potential Security Risk Ahead”). After you click “Advanced”, Firefox says that the certificate is not valid for this address and immediately lists the names it is valid for: “The certificate is only valid for: …”. The code is further down, after the words “Error Code”.

Chrome shows “Your connection is not private” with the code NET::ERR_CERT_COMMON_NAME_INVALID in this case. Edge shows a similar warning with the same code. After you click “Advanced”, Chrome says, for example: “This server could not prove that it is www.example.com; its security certificate is from example.com.” The second name is one of the addresses the certificate was issued for.

If it is someone else’s website

• Do not enter passwords, card details or personal data on it.
• Check the address. Sometimes the version with or without www works; type the address by hand instead of using an old bookmark.
• Firefox itself says the problem is most likely with the site. On a company network, ask your IT department, and if you use antivirus software, check whether it has known issues with encrypted connections.
• Let the site owner know, including the address you opened.

The most common causes on your own site

• A certificate without www or without the bare domain. The certificate was issued only for example.com, but the site also opens as www.example.com, or the other way round. These are two different names and both must be in the certificate.
• A subdomain not covered by the certificate, e.g. shop.example.com when the certificate covers only example.com and www.example.com.
• A wildcard certificate covers less than it seems. *.example.com covers www.example.com and shop.example.com, but not example.com itself nor a.b.example.com.
• The server shows the hosting provider’s generic certificate. When no certificate is assigned to the domain, the server answers with its default certificate, issued for the name of the hosting provider or the server.
• The address leads to another server. For example, after moving the site, the DNS record for www still points to the old hosting, where your certificate is not installed.

How to check which addresses a certificate covers

1. Firefox: on the warning page, click “Advanced”. The list of names follows the words “The certificate is only valid for:”. For full details, click “View the site’s certificate” and look under “Subject Alt Names” (each name on a “DNS Name” line).
2. Chrome: when the address opens without a warning, click the icon next to the address, then “Connection is secure” and “Certificate is valid”. The names are on the “Details” tab.
3. With the openssl command (Linux, macOS, Git Bash on Windows):

   echo | openssl s_client -connect example.com:443 \
     -servername example.com 2>/dev/null \
     | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

   The output lists the names with the prefix DNS:, e.g. DNS:example.com, DNS:www.example.com.

How to fix it on your own site

1. List all the addresses your site opens at: usually example.com and www.example.com, sometimes subdomains too.
2. In the generator, generate one certificate for all of these names, separated by commas, e.g. example.com, www.example.com (up to 10 names). For many subdomains, enter example.com, *.example.com (without a separate www, because the wildcard covers it); a wildcard certificate requires verification with a DNS record.
3. Upload the certificate following the guide for your hosting and check in the panel that it is assigned to the domain your site runs on.
4. On your own server, both names must be in the port 443 configuration: in nginx in the server_name line of the block with listen 443 ssl, in Apache in ServerName and ServerAlias of the <VirtualHost *:443> block.
5. If the address leads to another server, correct the A (or CNAME) record in the domain’s DNS zone.
6. Check both addresses, with and without www, in a private window. How to then send everyone to one address is explained on the page Redirecting http to https.