SSL_ERROR_BAD_CERT_DOMAIN

Error SSL_ERROR_BAD_CERT_DOMAIN, shown by Firefox and compatible with how Chromium browsers report the same condition, means the TLS certificate the server presented is technically valid but was issued for a different name than the one you visited. The browser refuses the connection because it cannot confirm the certificate belongs to the site you asked for. This is a name mismatch, not a broken or forged certificate.

What it means

When a browser opens a secure connection it checks several things about the certificate: who issued it, whether it is expired or revoked, and whether the hostname you typed appears in the certificate's list of names. That list lives in the Subject Alternative Name (SAN) extension. If the requested hostname is not covered by one of the SAN entries, the browser raises this error.

Modern browsers ignore the older Common Name field for hostname matching and require SANs, so a certificate that names only example.com does not cover www.example.com or mail.example.com unless those names are also listed. A single certificate can list many names, and a wildcard such as *.example.com covers one level of subdomains but not the bare domain.

The mismatch usually comes from the server side. Servers pick which certificate to present based on the hostname the browser sends during the TLS handshake, a mechanism called SNI. If the virtual host for your domain is misconfigured, or simply missing, the server falls back to a default certificate for a different site — and the browser correctly objects.

Common causes

• The certificate covers a different name — for example it lists example.com but you visited www.example.com or a subdomain.
• The server's default or misconfigured virtual host returns the wrong site's certificate for that SNI name.
• A name is missing from the SAN list, such as a subdomain that was never added when the certificate was issued.
• You reached the site by IP address, or by a hostname the certificate was never meant to serve.
• A CDN or hosting panel is serving its own default certificate because the custom domain was not attached.

How to fix it

1. Try the name the certificate covers. Add or remove www, or use the exact hostname from the certificate. If one form works and the other does not, the fix is a redirect or a wider certificate.
2. Inspect the SANs the server returns. Read the certificate the host actually serves and check its names:

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

3. Reissue the certificate with the right names. Include every hostname you serve. With Let's Encrypt's certbot, list them explicitly:

   certbot --nginx -d example.com -d www.example.com

4. Fix the virtual host and SNI mapping. Give the domain its own server block that points to its matching certificate, and make sure the server does not serve a default certificate for names it does not know.
5. Check any CDN or proxy. Attach the custom domain and upload a certificate that matches it, so the edge presents the correct name instead of its own default certificate.

How to prevent it

Issue certificates that match everything you serve. A multi-domain (SAN) certificate, or a wildcard plus its bare domain as needed, prevents the everyday mistakes: a new subdomain, a www form, or an internal alias that was never covered. Decide the exact names you will use and request them together.

Automate renewal and verify after every change. Let's Encrypt certificates last only ninety days, so set up automatic renewal and a check that warns you before expiry. When you add a domain, a subdomain or a new server, re-verify the certificate from outside with openssl s_client so a missing SAN or a wrong default host is caught before visitors see it.

Keep the server's name handling honest. One virtual host per name, pointed at the matching certificate, with no catch-all default that hands out the wrong one. Document which certificate belongs to which host, and when you migrate hosting or a CDN, confirm the edge presents the same names the origin does.