---
title: "ERR_CERT_COMMON_NAME_INVALID on Cloudflare: cause and fix"
description: "Cloudflare's universal certificate covers example.com and *.example.com only — a second-level subdomain such as api.staging.example.com is not covered, so…"
canonical: "https://lemwatch.com/errors/err-cert-common-name-invalid/in-cloudflare"
source: "https://lemwatch.com"
---

# ERR_CERT_COMMON_NAME_INVALID on Cloudflare

> Cloudflare's universal certificate covers example.com and *.example.com only — a second-level subdomain such as api.staging.example.com is not covered, so the name never matches.

## Why it happens on Cloudflare

 Cloudflare's universal certificate covers example.com and *.example.com only — a second-level subdomain such as api.staging.example.com is not covered, so the name never matches.

## The fix on Cloudflare

 Either flatten the hostname to one level, or buy Advanced Certificate Manager and add the deeper wildcard. Confirm the SSL/TLS mode is Full (strict) so the origin certificate is validated too.

## If that didn't fix it

 Cloudflare has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes. The most common one overall is: The certificate covers the apex domain but not the www hostname, or the reverse.

 Reissue covering both names, or redirect the uncovered hostname at the DNS/HTTP layer before TLS is negotiated — which is not possible over HTTPS, so the certificate must cover it.

## Check your own domain

 The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.

## Frequently asked questions

### Why does ERR_CERT_COMMON_NAME_INVALID happen on Cloudflare?

 Cloudflare's universal certificate covers example.com and *.example.com only — a second-level subdomain such as api.staging.example.com is not covered, so the name never matches.

### How do I fix ERR_CERT_COMMON_NAME_INVALID on Cloudflare?

 Either flatten the hostname to one level, or buy Advanced Certificate Manager and add the deeper wildcard. Confirm the SSL/TLS mode is Full (strict) so the origin certificate is validated too.

### What does ERR_CERT_COMMON_NAME_INVALID mean?

 The certificate is valid and trusted, but it was issued for a different hostname than the one in the address bar. The classic case is a certificate covering example.com being served for www.example.com.


## Related

- [All causes of ERR_CERT_COMMON_NAME_INVALID](https://lemwatch.com/errors/err-cert-common-name-invalid)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_CERT_COMMON_NAME_INVALID on AWS S3](https://lemwatch.com/errors/err-cert-common-name-invalid/in-aws-s3)
- [ERR_CERT_COMMON_NAME_INVALID on Chrome](https://lemwatch.com/errors/err-cert-common-name-invalid/on-chrome)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [Website monitoring overview](https://lemwatch.com/website-monitoring)