Editor's Note: As of 2024, this article has been reviewed and updated in accordance with the latest standards/conventions for SSL.
Ever landed on a website and received an error like this?
There are a number of different ways this can be presented, depending on the browser and the version of the browser you are using but whether you are a website visitor or the website owner, an error like this isn’t something you want to see! Let’s just start by explaining what this error means.
SSL Certificate with Wrong Hostname
An SSL certificate with wrong hostname or also known as a common name mismatch error occurs when the common name or SAN of your SSL Certificate does not match the domain or address bar in the browser. This can happen simply by visiting https://example.com instead of https://www.example.com if the certificate does not have them both listed in the SAN of the certificate.
A common name mismatch error occurs when the common name or SAN of your SSL Certificate does not match the domain or address bar in the browser. This can happen simply by visiting https://example.com instead of https://www.example.com if the certificate does not have them both listed in the SAN of the certificate.
First things first, if you are not the website owner, you need to get in touch with someone who is to fix the issue. DO NOT go ahead and continue anyway. It is quite possible that the error is showing because a hacker or phisher is trying to pass an impostor website off as the website you are trying to visit.
If you own the website or domain and you want to resolve this error, here are some tips to follow.
How to Solve a Common Name Mismatch Error
You could be having this issue for several reasons, so you should start with a thorough analysis. Start by entering the domain of your website into GlobalSign’s SSL checker.
The first thing to look for when doing this check is to find out what certificate is currently installed on the server or IP address. This will normally help you identify why you are getting the error, as there can be quite a few reasons.
The main thing to remember is there is nothing wrong with the SSL Certificate or with your website per se. At some point between someone visiting a domain and someone reaching your website, the wrong certificate is being presented.
You may need to contact your IT department to find out where the certificate was installed and where it is being configured.
The website address was not included in your common name by mistake.
It might be as simple as the example I mentioned above. You have purchased a certificate with the common name www.example.com, but not added example.com as a SAN to the certificate.
Make sure you click ‘Ignore Certificate Mismatch’ in the GlobalSign SSL Checker, and it will take you to a full analysis of the SSL Certificate on that domain. You can see from the Common Name and SAN section if the correct domains and IPs are included.
Correct Ips and SANs listed in certificate – common name mismatch error
When you order a certificate from GlobalSign with your common name as www.example.com, we will give you example.com for free if you validate on example.com. If you put example.com as your common name, we have a UC SAN option so you can add www.globalsign.com for free during your ordering process. You can also add it after issuance by editing your SAN options.
The website does not use SSL but shares an IP address with a site that does.
If your website is sharing an IP address with other sites, this may or may not matter and solutions may vary.
You may be on a shared host. Some hosting companies require a dedicated IP address to support SSL. If one of the customers sharing that IP address has installed an SSL Certificate on that shared IP, it could interfere with the other sites.
It could also be that the client connecting, or the server hosting (or both) do not support Server Name Indication (SNI). An example of this would be if you have example.com (default site) and example.org hosted on the same IP. You have certificates for both and they are both configured. If the server does not support SNI, only the default SSL Certificate will be served up. If the client does not support SNI, they will only see the default site’s certificate.
If the server and client support SNI, the correct certificate is served up each time. Pretty much all modern clients and servers support SNI but it can cause issues with legacy systems.
As a solution, you may have to support SNI or get a dedicated IP (which involves DNS settings changes).
The website no longer exists, yet the domain name still points to the old IP address, where some other site is now hosted.
DNS settings will help you here as well. Make sure the DNS is pointing to the new IP not the old one!
The hosting provider you go with has pre-configured settings which override your certificate installation.
Your hosting provider may have some settings pre-configured which force SSL on each of their domains. If you purchase an SSL Certificate from another third-party Certificate Authority and install it, you will see a mismatch error.
Like above, go to ‘Ignore Certificate Mismatch’ in the GlobalSign SSL Checker to see the full certificate details. If the common name or SAN includes the name of your hosting provider, this is probably what is happening.
You need to contact your hosting provider and have them remove their certificate so you can install yours. If they say they will not do this – switch hosting providers as this is bad practice. You should be able to get an SSL Certificate from wherever you want.
Configurations of your server or firewall.
You should pay attention to your firewall and load balancer settings. A firewall in particular can be set to grab a certificate from one server even though it points to multiple servers, so you need to make sure this is set up correctly.
Sadly, in this situation, you are the only one who can fix the issue and should have some IT knowledge or at least, have someone hired who can help you with IT.
In summary, it’s important to get all the information correct during the ordering process and have your server set-up and configured properly. If you aren’t sure about how to add a SAN or include your base domain in the ordering process, give us a call today.
If you think the issue lies with your server configurations, you should talk to your IT team or hosting company.
