Install a certificate that covers this hostname

Why it matters

The certificate the server presents is issued for other names, so browsers show a name-mismatch warning and refuse to continue silently. This happens when the host was never added to the certificate, or when the server picks the wrong certificate for the name.

The fix

1. Open the certificate details (command below) and compare the listed names (Subject Alternative Name) with the hostname people use.
2. If the name is missing, issue a new certificate that includes it (add a -d option for each name, or use a wildcard) and install it.
3. If the certificate is right but another site's certificate is served, the server is not matching this hostname to the right virtual host. Check the server_name or ServerName of the 443 listener and that the host has its own ssl_certificate.
4. For a hosting platform or CDN, add the hostname to the project or site so the platform issues a certificate for it.
5. Reload the server and confirm with the command below.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject