SSL Certificate Hostname Mismatch
What This Check Does
The SSL Certificate Hostname Mismatch check verifies that the SSL/TLS certificate served by your domain is actually valid for that domain name. DNS Spy compares the monitored hostname against the certificate's Subject Common Name (CN) and Subject Alternative Names (SANs). If the hostname does not match any of the names listed in the certificate, this check fails.
Why It Matters
A hostname mismatch means the certificate was not issued for the domain it's being used on. Browsers treat this as a critical error and display a security warning preventing users from proceeding. This often happens after domain migrations, CDN changes, or when a certificate is installed on the wrong server. It can also occur when the www and non-www variants of a domain aren't both covered by the certificate's SANs.
From a security standpoint, a mismatch might indicate a misconfigured reverse proxy or load balancer serving the wrong certificate — potentially leaking information about your internal infrastructure to external visitors.
Good vs. Bad Configuration
Bad Configuration
The server at example.com is serving a certificate issued for staging.example.com. The hostname does not match, so browsers display "NET::ERR_CERT_COMMON_NAME_INVALID" and block access.
Good Configuration
The server at example.com serves a certificate where the SAN list includes example.com and www.example.com. All monitored hostnames match entries in the certificate and connections proceed without errors.
How DNS Spy Monitors This
DNS Spy retrieves the SSL certificate for each monitored domain and validates the hostname against the certificate's CN and SAN fields during every monitoring cycle. A mismatch triggers an immediate alert. Installing the correct certificate — one that covers your monitored domain — will resolve the alert on the next check.
Related
Check This on Your Own Domain
DNS Spy's free scan reads your live DNS, nameservers, SSL and email-authentication records and reports what it finds. No account required. Scan a domain →
If you want the same checks to keep running: DNS Spy re-resolves every monitored domain at least every ten minutes and alerts you when a record changes. See how monitoring works →
Frequently asked questions
What causes an SSL hostname mismatch error?
The server presented a certificate that does not list the hostname you visited. Common causes are a certificate installed on the wrong server or virtual host, a CDN or load balancer serving a default certificate, a recent domain migration, or a certificate that covers example.com but not www.example.com.
How do I fix NET::ERR_CERT_COMMON_NAME_INVALID?
Install a certificate whose Subject Alternative Names include the exact hostname visitors use. Check which names the current certificate covers, reissue it with every hostname you serve, including the www variant, and make sure your web server, proxy or CDN presents that certificate for the domain. The error clears on the next connection.
Does an SSL certificate cover both www and non-www?
Only if both names are listed. A certificate covers exactly the hostnames in its Subject Alternative Names, so example.com and www.example.com must each appear or be matched by a wildcard. A wildcard like *.example.com covers www.example.com but not the bare example.com, so request both names when you issue it.
Is an SSL hostname mismatch a security risk?
Yes. Browsers block the page because they cannot confirm they are talking to the real site, and a mismatch is also what an interception attempt looks like. Even when the cause is a misconfiguration, it can expose internal hostnames from a proxy or load balancer and teaches visitors to click through warnings.
