---
title: "ERR_CERT_COMMON_NAME_INVALID on AWS S3: cause and fix"
description: "An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain."
canonical: "https://lemwatch.com/errors/err-cert-common-name-invalid/in-aws-s3"
source: "https://lemwatch.com"
---

# ERR_CERT_COMMON_NAME_INVALID on AWS S3

> An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

## Why it happens on AWS S3

 An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

## The fix on AWS S3

 Put CloudFront in front of the bucket and attach an ACM certificate for the custom domain in us-east-1. S3 alone cannot serve HTTPS on a custom domain.

## If that didn't fix it

 AWS S3 has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes. The most common one overall is: The certificate covers the apex domain but not the www hostname, or the reverse.

 Reissue covering both names, or redirect the uncovered hostname at the DNS/HTTP layer before TLS is negotiated — which is not possible over HTTPS, so the certificate must cover it.

## Check your own domain

 The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.

## Frequently asked questions

### Why does ERR_CERT_COMMON_NAME_INVALID happen on AWS S3?

 An S3 static site served over the bucket's default HTTPS endpoint presents a certificate for *.s3.amazonaws.com, which never matches a custom domain.

### How do I fix ERR_CERT_COMMON_NAME_INVALID on AWS S3?

 Put CloudFront in front of the bucket and attach an ACM certificate for the custom domain in us-east-1. S3 alone cannot serve HTTPS on a custom domain.

### What does ERR_CERT_COMMON_NAME_INVALID mean?

 The certificate is valid and trusted, but it was issued for a different hostname than the one in the address bar. The classic case is a certificate covering example.com being served for www.example.com.


## Related

- [All causes of ERR_CERT_COMMON_NAME_INVALID](https://lemwatch.com/errors/err-cert-common-name-invalid)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_CERT_COMMON_NAME_INVALID on Cloudflare](https://lemwatch.com/errors/err-cert-common-name-invalid/in-cloudflare)
- [ERR_CERT_COMMON_NAME_INVALID on Chrome](https://lemwatch.com/errors/err-cert-common-name-invalid/on-chrome)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [All monitoring checks](https://lemwatch.com/features)