How to Fix NET::ERR_CERT_COMMON_NAME_INVALID (Hostname Mismatch)

What is NET::ERR_CERT_COMMON_NAME_INVALID?

This error occurs when the SSL certificate delivered by the web server is cryptographically valid and unexpired, but does not cover the specific domain name typed in the browser's address bar.

Common scenarios include:

• The certificate covers example.com, but the user visited www.example.com (or vice versa).
• The certificate is a wildcard for *.example.com, but the user visited a multi-level subdomain like app.api.example.com (wildcards only match one subdomain level).
• Default virtual host misconfiguration: Nginx or Apache serves the default server's SSL certificate instead of the site-specific virtual host due to missing SNI (Server Name Indication).

How to Fix Hostname Mismatches with Certbot

Re-issue the certificate including all desired apex domains and subdomains as Subject Alternative Names (SANs):

sudo certbot --nginx -d example.com -d www.example.com -d api.example.com --expand