How the tools word it
| Node 26 tls | ERR_TLS_CERT_ALTNAME_INVALID: Hostname/IP does not match certificate's altnames: Host: wrong.test. is not in the cert's altnames: DNS:server.test |
|---|---|
| OpenSSL 3.6 s_client | verify error:num=62:hostname mismatch |
| curl 8.23 | curl: (60) SSL: no alternative certificate subject name matches target hostname 'wrong.test' |
| Python 3.14 ssl | ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'wrong.test'. (_ssl.c:1082) |
| Node 26, by IP address | ERR_TLS_CERT_ALTNAME_INVALID: Hostname/IP does not match certificate's altnames: IP: 127.0.0.1 is not in the cert's list: |
| OpenSSL 3.6 s_client, by IP address | verify error:num=64:IP address mismatch |
Common causes
The name is not in the certificate
This certificate lists one name, server.test. Under Check a hostname, the Decoder answers for any name you type. The check follows the browser rules: no fallback to the common name, and a wildcard covers one label.
Input
-----BEGIN CERTIFICATE----- MIIB7jCCAZWgAwIBAgIBBDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDRwAwRAIg VatubrykL+ZDu2wIXIFzNCA4G6SIsUQnf2mw4c30KXMCICf1jBo0UciVihHiS1KE k6cc1SY9pCBuOPjwOoiC3ob3 -----END CERTIFICATE-----
Certificate Decoder says
wrong.test: Not covered · No name in the certificate matches
A wildcard covers one label only
*.sample.example.com covers www.sample.example.com, but not a.b.sample.example.com, and a wildcard never covers the bare domain unless that name is listed too. This certificate lists both the bare domain and the wildcard.
Input
-----BEGIN CERTIFICATE----- MIIB1DCCAYagAwIBAgICICYwBQYDK2VwMDkxGjAYBgNVBAoMEWZqb3JkdG9vbHMg c2FtcGxlMRswGQYDVQQDDBJzYW1wbGUuZXhhbXBsZS5jb20wHhcNMjYwMTAxMDAw MDAwWhcNMzYwMTAxMDAwMDAwWjA5MRowGAYDVQQKDBFmam9yZHRvb2xzIHNhbXBs ZTEbMBkGA1UEAwwSc2FtcGxlLmV4YW1wbGUuY29tMCowBQYDK2VwAyEAGb9ECWmE zf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuGjgbEwga4wHQYDVR0OBBYEFKKMwfhu WWDT4DrnXJYsl6jUSCk8MB8GA1UdIwQYMBaAFKKMwfhuWWDT4DrnXJYsl6jUSCk8 MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUF BwMBMDkGA1UdEQQyMDCCEnNhbXBsZS5leGFtcGxlLmNvbYIUKi5zYW1wbGUuZXhh bXBsZS5jb22HBMAAAgEwBQYDK2VwA0EAKPCCNMpOqtzLZ1Vz4VQe1CjvHXN4LBAe Y5LOrtJQ62WvIfGua2gk3igtlb9uCoozH/sSSlbU3SLIR5WYBXvLBg== -----END CERTIFICATE-----
Certificate Decoder says
a.b.sample.example.com: Not covered · *.sample.example.com covers one label, and a.b is two
You connected by IP address
A DNS name in the certificate never matches an IP address. Only an IP address entry in the subject alternative names does, and most certificates have none. The error words are IP address mismatch in OpenSSL and IP: … is not in the cert's list in Node.
Input
-----BEGIN CERTIFICATE----- MIIB7jCCAZWgAwIBAgIBBDAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAwMRgwFgYDVQQKDA9mam9y ZHRvb2xzIHRlc3QxFDASBgNVBAMMC3NlcnZlci50ZXN0MFkwEwYHKoZIzj0CAQYI KoZIzj0DAQcDQgAE7ee19O78yqmyOB5x/h4K7/QA6YW32XJesJT8lv2Q+Y0GBR4e r2DpKzlXcNQ5G7VN9GkztuzSnXch/wKr38FQdqOBjjCBizAMBgNVHRMBAf8EAjAA MA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDATAWBgNVHREEDzAN ggtzZXJ2ZXIudGVzdDAdBgNVHQ4EFgQU/HjqRgLgUEQQDnr1y8nhCcb2baowHwYD VR0jBBgwFoAUMt7RDnv6EJHcKso7bd3VWZC9krowCgYIKoZIzj0EAwIDRwAwRAIg VatubrykL+ZDu2wIXIFzNCA4G6SIsUQnf2mw4c30KXMCICf1jBo0UciVihHiS1KE k6cc1SY9pCBuOPjwOoiC3ob3 -----END CERTIFICATE-----
Certificate Decoder says
127.0.0.1: Not covered · The certificate lists no IP addresses, and a DNS name never matches an IP address
A common name and no subject alternative names
Old certificates name the host only in the common name. Node, OpenSSL, curl and Python still accept that, but the Decoder follows the browsers, which do not. The same certificate works in a script and fails in a browser.
Input
-----BEGIN CERTIFICATE----- MIIBuzCCAWGgAwIBAgIBBzAKBggqhkjOPQQDAjBBMRgwFgYDVQQKDA9mam9yZHRv b2xzIHRlc3QxJTAjBgNVBAMMHGZqb3JkdG9vbHMgdGVzdCBpbnRlcm1lZGlhdGUw HhcNMjYwMTAxMDAwMDAwWhcNMzYwMTAxMDAwMDAwWjAWMRQwEgYDVQQDDAtzZXJ2 ZXIudGVzdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABO3ntfTu/Mqpsjgecf4e Cu/0AOmFt9lyXrCU/Jb9kPmNBgUeHq9g6Ss5V3DUORu1TfRpM7bs0p13If8Cq9/B UHajdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoG CCsGAQUFBwMBMB0GA1UdDgQWBBT8eOpGAuBQRBAOevXLyeEJxvZtqjAfBgNVHSME GDAWgBQy3tEOe/oQkdwqyjtt3dVZkL2SujAKBggqhkjOPQQDAgNIADBFAiBRNZfd tkQUGNZ1vedc77gZDG/wIwVjOSArE63R/qnlrwIhAKmVShbtvbwhh5IlwH0nQcRa zEJ4cGK0Lco9AgPUIoFG -----END CERTIFICATE-----
Certificate Decoder says
server.test: Not covered · No subject alternative names. Chrome rejects it for every name (NET::ERR_CERT_COMMON_NAME_INVALID); curl and Node still accept the CN
How to fix it
- Connect with a name the certificate lists. The Certificate Decoder's Check a hostname field answers for any name, and openssl x509 -noout -ext subjectAltName -in cert.pem prints the list.
- If the certificate is wrong for the site, have it reissued with the name in the subject alternative names. The common name alone is not enough for a browser.
- To reach a test server by a name the certificate lists, point that name at the server instead of using its IP: curl --resolve server.test:443:192.0.2.1 https://server.test/.
- To use an IP address, the certificate needs an IP entry in its subject alternative names (subjectAltName=IP:192.0.2.1).
- Do not turn hostname checking off (curl -k, rejectUnauthorized: false). That removes the protection for every server, not just this one.