ERR_CERT_COMMON_NAME_INVALID on Cloudflare
Why it happens on Cloudflare
Cloudflare's universal certificate covers example.com and *.example.com only — a second-level subdomain such as api.staging.example.com is not covered, so the name never matches.
The fix on Cloudflare
Either flatten the hostname to one level, or buy Advanced Certificate Manager and add the deeper wildcard. Confirm the SSL/TLS mode is Full (strict) so the origin certificate is validated too.
Is ERR_CERT_COMMON_NAME_INVALID happening on your domain?
The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
If that didn't fix it
Cloudflare has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes that apply everywhere. The most common one overall is: the certificate covers the apex domain but not the www hostname, or the reverse.
All causes and fixes for ERR_CERT_COMMON_NAME_INVALID