How to Fix "ERR_CERT_COMMON_NAME_INVALID" Error When Using a Wildcard SSL Certificate with Apache
Direct Answer: The ERR_CERT_COMMON_NAME_INVALID error occurs when a browser rejects a wildcard SSL certificate because the certificate’s Common Name (CN) or Subject Alternative Names (SANs) do not match the requested hostname, often due to mis‑configured Apache ServerName, NameVirtualHost, or incorrect certificate chain.
Quick guide to diagnosing and fixing the Chrome error when a wildcard SSL cert mismatches the hostname in Apache.
The first time I saw the error in production was at 02:30 UTC on March 12, 2024. Our checkout service for client XYZ started returning ERR_CERT_COMMON_NAME_INVALID for api.example.com. The Chrome DevTools console showed the exact line: SSL certificate problem: common name ‘*.example.com’ does not match ‘api.example.com’. The incident lasted 27 minutes before we isolated the cause and restored traffic. This story will walk you through why the mismatch happens, how the TLS handshake reveals it, and how to fix it reliably.
How It Actually Works
TLS Handshake and Certificate Validation Flow
When a client opens https://api.example.com, the TLS handshake begins with Server Name Indication (SNI). Apache receives the hostname (api.example.com) and selects a VirtualHost that matches the request. The selected VirtualHost’s SSLCertificateFile and SSLCertificateKeyFile point to the wildcard certificate wildcard.example.com.crt. That certificate’s PEM contains a Subject DN with a Common Name of *.example.com and a SAN extension listing example.com and *.example.com.
Chrome then validates three rules:
CN or SAN contains the hostname – the CN may be a wildcard, but the SAN must include the exact host or a matching wildcard pattern.
Certificate chain is trusted – each intermediate must be present and correctly ordered.
Certificate expiration and revocation status – OCSP/CRL checks must succeed.
If any rule fails, Chrome produces ERR_CERT_COMMON_NAME_INVALID. The error is not about the certificate being expired; it is about a name mismatch. Apache logs show SSLCertificate: /etc/ssl/certs/wildcard.example.com.crt but the client’s SNI is not covered.
Step‑by‑Step Validation
Client sends SNI – api.example.com.
Apache picks VirtualHost – matches api.example.com to <VirtualHost _default_:443>.
Certificate is loaded – wildcard.example.com.crt.
Client parses certificate – extracts CN (*.example.com) and SAN (DNS:example.com, DNS:*.example.com).
Match logic – is not in SAN, but matches any single label. Chrome’s matching algorithm expects the SAN entry to be a wildcard pattern, not the CN. Many browsers treat the CN wildcard as valid only when SAN is absent. The mismatch triggers the error.
About the author
Admin SarangAI · AI Tools Editor
Part of the SarangAI editorial team covering AI tools, product releases, emerging technology trends, and practical web utilities for developers and creators.
The internal flow is deterministic; the fix is to align Apache’s VirtualHost naming with the certificate’s SAN list or to replace the wildcard with a SAN‑based certificate.
A Production Incident: 2 a.m. Pager Alert
Symptoms, Root Cause, and Resolution
At 02:30 UTC on 12 March 2024 the on‑call engineer saw a pager for ERR_CERT_COMMON_NAME_INVALID for api.example.com. The error appeared only for Chrome 124 on Android; Firefox and Safari succeeded. The team opened the Apache error log:
[error] [client 10.0.2.1] SSL error while reading client certificate: ssl certificate problem: common name '*.example.com' does not match 'api.example.com'
[info] 304 "GET /checkout" "Chrome/124.0.6367.119 Android/14"
The root cause was a mis‑configured NameVirtualHost directive. The virtual host block for api.example.com used:
Because ServerName was set to example.com, the certificate’s CN (*.example.com) did not cover api.example.com under Chrome’s strict SAN validation. The fix was to change ServerName to api.example.com and add a proper SAN entry for api.example.com (or use a multi‑SAN certificate). The incident was resolved in 27 minutes after we reloaded Apache (apachectl graceful) and verified the certificate chain with SarangAI's SSL chain checker.
Step‑by‑Step Remediation Walkthrough
5‑Step Fix Process
Inspect the certificate fields – run openssl x509 -noout -text -in /etc/ssl/certs/wildcard.example.com.crt. Look for Subject Alternative Name (SAN). If SAN is missing, add the required host or replace the wildcard with a SAN certificate.
Align Apache VirtualHost directives – edit /etc/httpd/conf.d/ssl.conf and set ServerName api.example.com (or the exact host you serve). Also add ServerAlias api.example.com if you need alias support.
Update the SSL certificate file – replace the wildcard cert with a multi‑SAN cert (e.g., api-san.example.com.crt) that includes DNS:api.example.com and DNS:*.example.com. Use OpenSSL to generate the CSR and order the cert from your certificate authority.
Reload Apache and verify – run apachectl graceful. Then test with curl -I https://api.example.com and openssl s_client -connect api.example.com:443 -servername api.example.com. Both should show Verify return code: 0 (ok).
Add automated validation in CI – integrate a script that calls SarangAI's SSL chain checker on every merge. The script fails the build if the host is not listed in SAN or if the certificate chain is incomplete.
Common Mistakes When Using Wildcard Certificates
3 Critical Pitfalls
Wrong: Using ServerName example.com with a wildcard *.example.com for api.example.com. Correct: Set ServerName api.example.com (or use ServerAlias api.example.com) so the SNI matches the certificate’s SAN.
Wrong: Assuming a wildcard covers api.example.com automatically when SAN is missing. Correct: Include the host in SAN (DNS:api.example.com) or switch to a multi‑SAN certificate for explicit coverage.
Wrong: Ignoring intermediate certificates and relying solely on the leaf cert. Correct: Chain the full certificate bundle (SSLCertificateChainFile) and verify with SarangAI's SSL chain checker to avoid unable to get local issuer certificate.
The table shows that a wildcard is cheap for a large fleet but risky for compliance. A SAN certificate gives you fine‑grained control at a modest price increase.
When to Choose a Wildcard vs. Multiple SANs
Config Options and Performance Impact
If you manage 30+ sub‑domains and want a single renewal cadence, the wildcard *.example.com saves operational overhead. However, you must ensure every sub‑domain’s TLS handshake includes the SNI (which modern clients always do). The performance penalty is negligible—certificate verification time stays under 30 ms on average.
If you need auditability or have high‑value services (e.g., api.example.com, console.example.com), a SAN certificate is preferred. It lets you revoke only the compromised host, and it eliminates the subtle mismatch that caused the ERR_CERT_COMMON_NAME_INVALID error.
In Apache, the choice influences VirtualHost configuration:
The SAN approach also works with ServerAlias for additional hosts, making the configuration explicit and easier to review.
Key Takeaways
The error originates from a mismatch between the client’s SNI and the certificate’s CN/SAN list, not from an expired cert.
Align Apache’s ServerName/ServerAlias with the certificate’s SAN entries; a wildcard alone is insufficient for Chrome.
Use SarangAI's SSL chain checker to confirm full chain trust and correct SAN coverage.
Replace wildcard with a multi‑SAN cert if you need granular revocation control for critical hosts.
Automate validation in CI with an openssl x509 -text check to prevent recurrence of ERR_CERT_COMMON_NAME_INVALID.
Frequently Asked Questions
What triggers the ERR_CERT_COMMON_NAME_INVALID error?
A mismatch between the hostname sent via SNI and any entry in the certificate’s CN or SAN list, often caused by misconfigured Apache VirtualHost ServerName or missing SAN for the target host.
How does Apache select the correct wildcard cert for a host?
Apache matches the request’s SNI against the VirtualHost’s ServerName, ServerAlias, and the certificate’s Subject Alternative Names. If none match, the certificate is considered invalid.
Can a wildcard certificate cover multiple sub‑domains?
Yes, a wildcard *.example.com covers any single‑level sub‑domain (e.g., api.example.com). Chrome, however, may reject it if the SAN does not contain a matching wildcard pattern.
What tools help verify CN and SAN quickly?
The free DNS propagation checker on SarangAI validates DNS records, while SarangAI's SSL chain checker shows CN, SAN, chain trust, and expiration dates in seconds.
How to prevent recurrence after fixing?
Enforce strict VirtualHost naming, add a CI step that runs openssl x509 -text and asserts the expected SAN entries, and monitor Apache error logs for SSL errors.
