Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.
Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.
Re-issue the certificate with every hostname listed as a SAN entry — including the bare domain and the www variant. The check below lists the exact SANs the server is presenting.
Chrome has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes. The most common one overall is: The certificate covers the apex domain but not the www hostname, or the reverse.
Reissue covering both names, or redirect the uncovered hostname at the DNS/HTTP layer before TLS is negotiated — which is not possible over HTTPS, so the certificate must cover it.
The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.
Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.
Re-issue the certificate with every hostname listed as a SAN entry — including the bare domain and the www variant. The check below lists the exact SANs the server is presenting.
The certificate is valid and trusted, but it was issued for a different hostname than the one in the address bar. The classic case is a certificate covering example.com being served for www.example.com.