ERR_CERT_COMMON_NAME_INVALID: Fix It

ERR_CERT_COMMON_NAME_INVALID is a Chrome error that appears when a website’s SSL/TLS certificate does not match the domain name in the address bar. The connection is blocked to protect you from potential impersonation, but the fix is usually straightforward: refresh the page, check your system clock, or clear the browser cache. Below, we break down what causes the error, how to resolve it, and how to prevent it from happening again.

What Does the Error Mean?

Every secure website presents a digital certificate issued by a trusted Certificate Authority (CA). That certificate is tied to a specific domain name (or a list of names). When your browser connects to example.com, it checks that the certificate’s “Common Name” (CN) or “Subject Alternative Name” (SAN) includes example.com. If there’s a mismatch, Chrome aborts the connection and shows ERR_CERT_COMMON_NAME_INVALID. The error is part of Chrome’s “not secure” warnings, which also include NET::ERR_CERT_AUTHORITY_INVALID and NET::ERR_CERT_DATE_INVALID.

Why Does the Mismatch Happen?

• Typo in the address – You might have typed www.example.com while the certificate only covers example.com (or vice versa).
• Outdated cached certificate – Your browser may have stored an old certificate that no longer matches the current one.
• Incorrect system clock – If your device’s date or time is off by more than a few minutes, the browser cannot validate the certificate’s validity period, which can trigger this error.
• Misconfigured server – The website owner may have installed a certificate for a different domain, or the server is serving a certificate for a virtual host that doesn’t match the requested URL.
• Corporate or ISP interception – Some networks (like hotels or workplaces) intercept HTTPS traffic with their own certificate, which won’t match the destination domain.

How to Fix It on Your Device

Most fixes are quick and don’t require technical expertise. Try them in order:

1. Refresh the page – Press Ctrl+F5 (Windows) or Cmd+Shift+R (Mac) to force a reload and bypass the cache.
2. Check the URL – Look for typos, extra dots, or a missing “www”. If the site uses a different subdomain, the certificate may not cover it.
3. Check your system date and time – Go to your device’s settings and ensure the time, timezone, and date are correct. Enable “Set automatically” if available.
4. Clear the browser cache and SSL state – In Chrome, go to Settings → Privacy and security → Clear browsing data. Check “Cached images and files” and also clear “SSL state” (on Windows, via Internet Options → Content → Clear SSL state).
5. Try a different network – If you’re on a public Wi-Fi or corporate network, switch to a mobile hotspot and see if the error disappears.
6. Restart the browser or device – A fresh session often clears temporary glitches.

What to Do If You’re the Website Owner

If the error appears for your own site, the problem is on the server side. Here’s what to check:

• Certificate domain coverage – Verify that the certificate’s Common Name (CN) or Subject Alternative Name (SAN) includes all the domains and subdomains you want to use. For example, a certificate for example.com does not automatically cover www.example.com.
• Reissue the certificate – If the certificate is missing a domain, obtain a new one that includes the correct SANs. Most modern CAs issue certificates with multiple SANs.
• Check the server configuration – Ensure your web server (Apache, Nginx, IIS) is serving the correct certificate for each virtual host. A common mistake is using a default certificate for all domains.
• Renew before expiry – An expired certificate can also trigger this error, though it usually shows a different message. Set up auto-renewal with your CA.
• Test with an online checker – Use a tool like SSL Labs to see exactly what certificate is being presented and which domains it covers.

How to Safely Proceed When You See the Error

Chrome shows a warning with a “Advanced” button that lets you proceed to the site anyway. Do not click through unless you are absolutely sure the site is legitimate. The error means the site’s identity cannot be verified, which could indicate a malicious impersonation. If you’re on a trusted network and the URL is correct, it’s likely a temporary glitch. But if you see the warning on a banking or shopping site, close the tab and try again later, or contact the site’s support team.

Common Misconceptions

• “It’s a virus” – The error itself is not a virus, but it can be caused by malware that redirects traffic. Run a security scan if you see the error on many sites.
• “The site is down” – The site may be perfectly fine; the issue is the certificate, not the server’s availability.
• “I can ignore it” – Ignoring the warning and proceeding can expose you to man-in-the-middle attacks. Always verify the reason before bypassing.

Prevention Tips for Users and Site Owners

• For users: Keep your browser and operating system updated. Use a reliable DNS service (like Google Public DNS or Cloudflare) to avoid DNS-based interception.
• For site owners: Use a certificate that covers both the apex domain and “www” (or set up a redirect). Monitor certificate expiry with tools like Certbot or your hosting provider’s dashboard.
• For both: Be cautious when using public Wi-Fi. A VPN can help protect against local network tampering.

Frequently Asked Questions

Is ERR_CERT_COMMON_NAME_INVALID the same as a security breach?

No. It simply means the certificate doesn’t match the domain name. It could be a harmless misconfiguration, but it could also indicate an attack. Treat it as a warning sign and verify the site’s legitimacy.

Can I bypass this error?

Yes, you can click “Advanced” and then “Proceed to [site] (unsafe)” in Chrome. However, this is not recommended unless you are certain the site is safe and you understand the risks. For a real fix, address the underlying cause.

Why does this error appear on my own website?

Most likely the certificate you installed doesn’t cover the domain you’re trying to access. Check the certificate’s SAN list. If you’re using a shared hosting provider, you may need to select the correct certificate in the hosting control panel.

Will clearing my browser cache fix it?

Sometimes, yes. If the browser cached an old certificate or a redirect, clearing the cache and SSL state can resolve the mismatch. It’s a quick step to try before more complex fixes.

Does this error affect mobile browsers?

Yes, similar errors appear on iOS Safari and Android Chrome. The fixes are the same: check the date/time, clear browsing data, and ensure the URL is correct.

Is there a difference between CN and SAN?

Yes. The Common Name (CN) is the legacy field that used to hold the domain name, but modern browsers rely on the Subject Alternative Name (SAN) extension, which can list multiple domains. A certificate with a CN but no SAN may trigger this error in current browsers.

Related

• Pomodoro Timer: What Helps When You Can’t Start a Task?
• Human-in-the-Loop AI: What Agencies Must Know
• Asset Visibility Plan: What Federal Agencies Must Include