"Certificate Belongs to a Different Address": Fixing a Name Mismatch

Your site has a certificate, it has not expired, and yet some visitors see a warning that the certificate belongs to a different address. This is a name mismatch. It sounds technical, but the cause is nearly always simple: the address in the browser is not on the list of names inside the certificate.

What visitors see

• Chrome and Edge: "Your connection is not private" with the code NET::ERR_CERT_COMMON_NAME_INVALID. Under Advanced, Chrome says the server could not prove it is your domain and names the address the certificate is really for.
• Firefox: "Warning: Potential Security Risk Ahead" with SSL_ERROR_BAD_CERT_DOMAIN.
• Safari: "This Connection Is Not Private".

That last detail in Chrome is the most useful clue. If it names your hosting company's server, your old domain or only the www version, you already know which fix you need.

How a certificate decides what is "the right address"

Every certificate carries a list of names, called Subject Alternative Names. Browsers check the address in the bar against that list and nothing else. yourdomain.com and www.yourdomain.com are two different names, so both must be on the list. A wildcard name such as *.yourdomain.com covers one level only: it covers shop.yourdomain.com, but not yourdomain.com itself and not a.shop.yourdomain.com.

How to see which names your certificate covers

1. Open your site, click the icon to the left of the address and open the certificate details.
2. Find Subject Alternative Names (sometimes shown as "DNS Name"). That is the full list.
3. Try every address people might use: with and without www, any old domain you own, and subdomains such as shop. or book..

A free online server test, such as the one from Qualys SSL Labs, also reports a name mismatch clearly. If you are comfortable with a terminal, openssl s_client -connect yourdomain.com:443 -servername yourdomain.com prints the certificate the server sends.

The four usual causes and how to fix them

1. www vs non-www

The certificate covers yourdomain.com but not www.yourdomain.com, or the other way round. Business cards and old links often use the version that is missing.

Fix: reissue the certificate with both names. In most hosting panels you tick both versions in the SSL section; with Let's Encrypt one certificate can hold many names. Then pick one main address and add a permanent (301) redirect from the other. Note the order: the browser checks the certificate before it follows any redirect, so a redirect alone cannot hide a missing name.

2. An old domain

You moved from an old domain to a new one, and the old name still points at your server. The server sends the new certificate, which does not list the old name, so everyone using an old link sees a warning.

Fix: keep the old domain registered, add it to a certificate, and 301-redirect every old address to the matching new page. Google's site move guidance says to keep those redirects for as long as possible, generally at least a year, so search rankings follow you.

3. A subdomain nobody added

A booking page, shop or blog on shop.yourdomain.com was set up later, or by a different supplier, and never got its own certificate. Ask whoever runs that part of the site to add the name, or use a certificate that covers it.

4. A CDN or new host that is not set up for your name

When your domain points at a CDN, a proxy or a new host, that service must have a certificate for your name. If it does not, visitors get its default certificate, which names the provider instead of you. This happens most often just after a move, when DNS already points to the new place but the certificate there was never issued.

Fix: in the CDN or host dashboard, add every name you use and wait for the certificate to show as active. Check your DNS records too: a forgotten record can still point one name at an old server that has no valid certificate.

Check your fix

• Open each address you tested earlier in a private window on a phone and a computer. Every one should load without a warning and land on your main address.
• Confirm the redirect is permanent (301) and goes straight to the matching page, not always to the homepage.
• In Google Search Console, a Domain property covers every version of your address, so you can watch for problems in one place.

When to ask for help

Ask a professional if the certificate keeps losing a name after renewal, if several services share your domain, or if you are not sure which provider controls the DNS. Read our guide to other invalid certificate warnings if the error code is different.