---
title: "ERR_CERT_COMMON_NAME_INVALID on Chrome: cause and fix"
description: "Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only…"
canonical: "https://lemwatch.com/errors/err-cert-common-name-invalid/on-chrome"
source: "https://lemwatch.com"
---

# ERR_CERT_COMMON_NAME_INVALID on Chrome

> Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.

## Why it happens on Chrome

 Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.

## The fix on Chrome

 Re-issue the certificate with every hostname listed as a SAN entry — including the bare domain and the www variant. The check below lists the exact SANs the server is presenting.

## If that didn't fix it

 Chrome has its own failure mode, but ERR_CERT_COMMON_NAME_INVALID has a wider set of causes. The most common one overall is: The certificate covers the apex domain but not the www hostname, or the reverse.

 Reissue covering both names, or redirect the uncovered hostname at the DNS/HTTP layer before TLS is negotiated — which is not possible over HTTPS, so the certificate must cover it.

## Check your own domain

 The SSL check reports which names the served certificate actually covers, which is the whole answer to this error in one line.

## Frequently asked questions

### Why does ERR_CERT_COMMON_NAME_INVALID happen on Chrome?

 Chrome ignores the legacy commonName field entirely and validates only Subject Alternative Names, so certificates that still work in older tooling fail only in Chrome.

### How do I fix ERR_CERT_COMMON_NAME_INVALID on Chrome?

 Re-issue the certificate with every hostname listed as a SAN entry — including the bare domain and the www variant. The check below lists the exact SANs the server is presenting.

### What does ERR_CERT_COMMON_NAME_INVALID mean?

 The certificate is valid and trusted, but it was issued for a different hostname than the one in the address bar. The classic case is a certificate covering example.com being served for www.example.com.


## Related

- [All causes of ERR_CERT_COMMON_NAME_INVALID](https://lemwatch.com/errors/err-cert-common-name-invalid)
- [All website error codes](https://lemwatch.com/errors)
- [ERR_CERT_COMMON_NAME_INVALID on Cloudflare](https://lemwatch.com/errors/err-cert-common-name-invalid/in-cloudflare)
- [ERR_CERT_COMMON_NAME_INVALID on AWS S3](https://lemwatch.com/errors/err-cert-common-name-invalid/in-aws-s3)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [ERR_CERT_DATE_INVALID: The certificate has expired or is not yet valid](https://lemwatch.com/errors/err-cert-date-invalid)
- [Lemwatch pricing](https://lemwatch.com/pricing)