Certificate Does Not Match This Domain

What it means

The certificate this server presents is valid, but it was not issued for the domain being served. Browsers treat that as a security failure and block the page, even though the certificate itself may be perfectly legitimate for a different hostname.

Why it matters

TLS verifies two things together: that the connection is encrypted, and that the certificate actually belongs to the domain being visited. A certificate for the wrong hostname breaks the second half of that guarantee — an attacker able to intercept traffic could present any certificate they hold and it would look just as "invalid" to the browser, so browsers can't distinguish a misconfiguration from an attack and block the page either way.

What Nivaronix checks

Nivaronix compares the domain being scanned against the certificate's Subject Alternative Names (and Common Name, checking for a wildcard match) presented during the TLS handshake. A mismatch raises this finding, listing which names the certificate is actually valid for. This is a hostname-verification check, not a scan for server-side vulnerabilities.

Example evidence

Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.

Illustrative example only — not a live scan result.

Domain scanned: shop.example.com
Certificate is valid for: www.example.com, example.com
Status: HOSTNAME MISMATCH

How to fix it

• Issue a certificate that covers the domain, or serve this domain from the host its certificate was issued for.
• Add the domain to the certificate's Subject Alternative Names (or use a wildcard covering it) and reinstall.
• If several sites share this server or load balancer, check that the virtual host configuration selects the right certificate for this specific hostname (SNI misconfiguration is a common cause).

How to verify the fix

Re-run the SSL/TLS checker against the domain and confirm it now reports a matching hostname. `openssl s_client -connect hostname:443 -servername hostname` followed by inspecting the certificate's Subject Alternative Name field will show the same thing directly.