networking ssl_tls ai_generated true

SSL: hostname mismatch - certificate CN does not match

ID: networking/ssl-hostname-mismatch

Also available as: JSON · Markdown
91%Fix Rate
89%Confidence
55Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3 active — — —

Root Cause

The hostname used to connect does not match the Common Name (CN) or Subject Alternative Names (SANs) in the server's SSL certificate. Modern TLS clients require the server hostname to appear in the SAN extension.

generic

Workarounds

  1. 95% success Reissue the certificate with the correct hostname in the SAN field 
    1. Create an openssl config with SANs:
   [req]
   req_extensions = v3_req
   [v3_req]
   subjectAltName = DNS:yourdomain.com,DNS:www.yourdomain.com
2. Generate CSR: openssl req -new -key server.key -out server.csr -config san.cnf
3. Submit CSR to your CA for signing
4. Install the new certificate with correct SANs
5. Verify: openssl x509 -in cert.pem -text -noout | grep -A1 'Subject Alternative Name'
  2. 88% success Use the exact hostname that matches the certificate's CN/SAN 
    1. Check what names the cert is valid for: openssl s_client -connect host:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep -A1 'Subject Alternative Name'
2. Use the listed domain name instead of an IP address or alternate hostname
3. Update your client configuration, DNS CNAME records, or reverse proxy settings to use the matching hostname

Dead Ends

Common approaches that don't work:

  1. Add the mismatched hostname to /etc/hosts to force DNS resolution to the IP 95% fail

    DNS resolution is not the problem. The TLS client validates the hostname against the certificate fields, not against DNS. Changing /etc/hosts does not modify the certificate's CN or SANs, so the mismatch error persists.

  2. Disable SNI (Server Name Indication) in the client 85% fail

    Disabling SNI does not fix hostname validation. SNI tells the server which certificate to present in multi-tenant setups; disabling it may cause the server to return the wrong certificate entirely, making the mismatch worse.

Error Chain

Leads to:
Preceded by:
Frequently confused with: