The short version
- 01Record the complete hostname in the address bar and the certificate-name error.
- 02Ask the administrator for the full hostname if an abbreviated work address produces the warning.
- 03On public Wi-Fi, open an HTTP page such as http://example.com to reach the expected network sign-in portal.
- 04Test the original address in Incognito, keep the operating system current and report a persistent warning to the owner.
- 05As a Cloudflare owner, check whether the affected hostname is proxied and covered by the certificate.
- 06Provision certificate coverage for deeper hostnames according to the Cloudflare setup type while retaining validation.
Raw message
NET::ERR_CERT_COMMON_NAME_INVALID
Likely causes
- The server presents a certificate for a different hostname.
- A Wi-Fi network redirects the connection to its sign-in page.
- An abbreviated address is expanded with a DNS suffix that the certificate does not cover.
- A Cloudflare full-DNS setup uses Universal SSL for a hostname below the first subdomain level.
Check the full address before changing settings
Chromium's definition is a certificate name that does not match the hostname. It lists a misconfigured server, a Wi-Fi login redirect and an operating-system DNS suffix among the possibilities. The suffix case can arise when the browser uses an abbreviated address whose expanded name is not covered by the certificate.
Our recommendation is to record the complete failing address. For an abbreviated work address, ask the administrator which full hostname to use. Keep certificate validation in place while the mismatch is investigated; a comparison or a plausible-looking address does not establish the server's identity.
Check whether the Wi-Fi network needs a sign-in
Google's certificate-error instructions begin with the sign-in portal on networks such as airport or cafe Wi-Fi. Open a page using HTTP, such as http://example.com, to reach the network's sign-in page, then try the original address again.
Our recommendation is to use this step only for a network whose portal you expect. Complete the network's normal sign-in without bypassing the certificate warning on the website you originally wanted to visit.
Use Google's browser check, then report the mismatch
Google also lists an Incognito test and operating-system updates. If the page works in Incognito, our recommendation is to test extensions individually to investigate the difference. A working private window does not establish that a particular extension caused the error.
If the warning persists, Google directs users to the site owner. Our recommendation is to send the complete hostname, code and comparison result; on a managed device, include your administrator so the network path can also be checked.
Cloudflare owners: check setup type and hostname depth
Cloudflare's error guidance checks whether the affected hostname is proxied and whether the certificate covers it. In a full-DNS setup, Universal SSL covers the root domain and first-level subdomains, such as example.com and www.example.com. A name such as dev.www.example.com needs additional coverage through Total TLS, an advanced certificate or a suitable custom certificate.
The current Universal SSL document makes a separate distinction for partial CNAME setups: each proxied subdomain receives its own certificate regardless of depth. Check which setup you use before applying the first-level limit. Our recommendation is to retain the failing hostname as the test after correcting coverage.
Sources and review notes
Checked on . Based on Chromium's error definition, Google's certificate-error checks and Cloudflare's SSL and certificate-coverage documentation. Address recording, extension isolation and administrator routing are editorial guidance. Cloudflare's full-DNS and partial CNAME setups have different coverage behavior. Glitchary is independent of Google and Cloudflare.