ERR_CERT_COMMON_NAME_INVALID on AWS S3

An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

Why it happens on AWS S3

An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

The fix on AWS S3

Put CloudFront in front of the bucket and attach an ACM certificate for the custom domain in us-east-1. S3 alone cannot serve HTTPS on a custom domain.

If that didn't fix it

AWS S3 has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes. The most common one overall is: The certificate covers the apex domain but not the www hostname, or the reverse.

Reissue covering both names, or redirect the uncovered hostname at the DNS/HTTP layer before TLS is negotiated — which is not possible over HTTPS, so the certificate must cover it.

Check your own domain

The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.

Frequently asked questions

Why does ERR_CERT_COMMON_NAME_INVALID happen on AWS S3?

An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

How do I fix ERR_CERT_COMMON_NAME_INVALID on AWS S3?

Put CloudFront in front of the bucket and attach an ACM certificate for the custom domain in us-east-1. S3 alone cannot serve HTTPS on a custom domain.

What does ERR_CERT_COMMON_NAME_INVALID mean?

The certificate is valid and trusted, but it was issued for a different hostname than the one in the address bar. The classic case is a certificate covering example.com being served for www.example.com.