Encountering a browser error when trying to access a website can halt your workflow immediately. When Chrome stops a page and prints NET::ERR_CERT_COMMON_NAME_INVALID, it means the name written on a site’s SSL certificate does not match the address you asked for. While most cases trace back to the server, a smaller share come from your own device, a rogue extension, or security software sitting in the middle.
Understanding where the error originates helps you apply the correct fix quickly. Below is a comprehensive guide tailored for both website visitors and site administrators to resolve the mismatch efficiently.
What is the ERR_CERT_COMMON_NAME_INVALID Error?
The common name (CN) is the exact domain a certificate was issued for. A certificate bought for shop.example.com vouches for that specific name and nothing else. When you request example.com instead, the browser spots a mismatch and refuses the connection, printing “Your connection is not private” above the error code. Other browsers like Firefox and Safari word the same fault differently, but the underlying verification failure remains identical.
Modern browsers look beyond the basic common name to include Subject Alternative Names (SAN), which list extra domains and subdomains attached to a single certificate. If your requested URL fails to appear in either the CN or SAN list, the browser halts the handshake for security reasons.
Self-signed certificates cause the same block because they lack verification from a trusted Certificate Authority. These belong strictly on internal test machines. Notably, Chrome removed the old workaround for self-signed certificates on localhost starting in version 119, making proper certificate handling even more critical for developers.
Common Causes of the Mismatch
The triggers for this certificate warning fall into three distinct categories:
- Server-side issues: The host machine serves a certificate that does not cover the hostname or subdomain being requested, or the site owner switched to HTTPS without installing a valid certificate.
- Client-side issues: Your device carries an incorrect system clock, a faulty browser add-on, or stale SSL cache data.
- Intermediary software: Outside applications such as a firewall or antivirus program intercept encrypted traffic and inject their own validation certificates.
| Requested URL | Certificate Common Name (CN) | Resulting Status |
|---|---|---|
| example.com | shop.example.com | ERR_CERT_COMMON_NAME_INVALID |
| www.example.com | example.com (missing www) | ERR_CERT_COMMON_NAME_INVALID |
| test.local | Self-signed (Chrome 119+) | Blocked by browser policy |
Fixes for Website Visitors
If you are trying to view a public website and encounter this error, run through these quick client-side troubleshooting steps:
- Correct the date and time: A laptop or phone running the wrong day or hour fails certificate validation outright. Open your system panel and switch on automatic sync. An incorrect clock also produces date-based certificate warnings, so check this first.
- Rule out a broken extension: Load the page in an Incognito window. Extensions stay off there by default, so a clean load points straight at an add-on. Open the menu, select More tools, then Extensions, and switch items off one at a time until the page opens.
- Update Chrome and your operating system: Old builds miss support for current TLS versions. That gap shows up as certificate errors and protocol mismatches during the handshake. Go to Help and About Google Chrome to install pending updates.
How to Clear SSL State in Windows
Cached certificate data can go stale and keep the security block alive even after a server fault is resolved. To clear your stored SSL state on Windows:
- Open Internet Properties via the Control Panel or by searching in the start menu.
- Navigate to the Content tab.
- Click the Clear SSL state button.
- Open Chrome settings, navigate to proxy settings, and ensure your configuration is clean. Flushing your DNS cache via the command line also helps clear any wrong IP pinned to the domain.
Fixes for Website Owners and Admins
If the error originates from a server you manage, you must address the configuration directly:
- Inspect the certificate on the server: Click “Not secure” beside the web address in Chrome, then choose Certificate. Read the “issued to” line and compare it against your actual hostname. Running an SSL Labs scan provides a deeper breakdown of every Subject Alternative Name attached to the certificate. If none match, the certificate requires reissuing.
- Cover both www and non-www: Some certificates protect only one spelling of a domain. Redirecting visitors from a bare address to a www version then trips the mismatch. Choose a certificate that lists both, or use a wildcard/multi-domain product to cover every subdomain under one purchase.
- WordPress installation fixes: Many site owners switch a site to HTTPS with nothing bought and nothing installed, prompting Chrome to answer with the error on every page load. You must buy a certificate and install it properly on the host, or temporarily drop back to HTTP to leave traffic unencrypted while resolving the setup.
Advanced Network and Software Checks
When local browser fixes and server inspections do not clear the issue, inspect network configurations and security utilities:
- Check your proxy configuration: Automatic detection left unticked limits web access on some networks. Right-click your network icon to reach Internet Properties, open the Connections tab, then click LAN Settings. Tick “Automatically detect settings” if the box sits empty, and reload the page.
- Read firewall and antivirus logs: Security suites that scan HTTPS traffic insert their own certificate into the connection chain. Open your security software log files to confirm neither tool is blocking the site. Read the stated reason before taking action, and remember that switching your antivirus off permanently is never the right solution.
To determine ownership of the bug, try testing the site on a second device and a separate network. If it fails on both, nothing on your end will fix it; the site owner must reissue or reinstall the certificate.
Should You Bypass the Warning?
Browsers allow you to click Advanced on the warning page and select Proceed to bypass the block. However, you should only do this on sites you completely trust. Never bypass a certificate warning when entering passwords, personal data, or payment details, as an active mismatch could indicate a machine-in-the-middle interception.
Frequently Asked Questions
What does ERR_CERT_COMMON_NAME_INVALID mean?
It means the domain on the site’s SSL certificate does not match the address in your browser. Chrome cannot verify that the site is who it claims to be, so it blocks the connection for your protection.
How do I bypass ERR_CERT_COMMON_NAME_INVALID?
Click Advanced on the warning page, then click Proceed. Do this only on sites you already trust, and never while entering passwords or payment details.
Is ERR_CERT_COMMON_NAME_INVALID a virus?
No. The code reports a name mismatch on a certificate. Server misconfiguration explains most cases, though a hijacked or spoofed domain can occasionally produce the same warning.
What is the common name in an SSL certificate?
The common name is the exact domain a certificate was issued for, such as example.com. Modern browsers also read Subject Alternative Name entries, which list extra domains and subdomains.
Can I fix ERR_CERT_COMMON_NAME_INVALID if I do not own the site?
Only partly. You can correct your system clock, test in Incognito mode, clear your SSL state, and update Chrome. If the error survives across multiple devices, the site owner must reissue the certificate.
