Error map

no alternative certificate subject name matches target host name curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com'

SSL / TLS · layer 2, Network

Open the full error page →

Centre: this error. First ring: errors it is linked with (8). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.

1 · On your device 2 · Network 3 · Edge & web server 4 · Application & API 7 · Build & delivery
no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternat…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMO…curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL cert…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certi…AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server cer…SSL_ERROR_BAD_CERT_DOMAIN — Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN (SSL / TLS)SSL_ERROR_BAD_CERT_…No subject alternative names present — Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found (SSL / TLS)No subject alternat…wildcard certificate does not cover a.b.example.com — Browser: *.example.com certificate does not match a.b.example.com (ERR_CERT_COMMON_NAME_INVALID) (SSL / TLS)wildcard certificat…CRYPT_E_NO_REVOCATION_CHECK — curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate (SSL / TLS)CRYPT_E_NO_REVOCATI…526 — Cloudflare Error 526: Invalid SSL Certificate (Cloudflare)526ERR_CERT_AUTHORITY_INVALID — NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private) (JavaScript)ERR_CERT_AUTHORITY_…ERR_TLS_CERT_ALTNAME_INVALID — Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames (Node.js)ERR_TLS_CERT_ALTNAM…unable to get local issuer certificate — OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED (SSL / TLS)unable to get local…DEPTH_ZERO_SELF_SIGNED_CERT — Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT) (SSL / TLS)DEPTH_ZERO_SELF_SIG…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during conn…SELF_SIGNED_CERT_IN_CHAIN — npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain (npm)SELF_SIGNED_CERT_IN…ERR_TOO_MANY_REDIRECTS (Cloudflare) — ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop) (Cloudflare)ERR_TOO_MANY_REDIRE…ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare) — ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain) (Cloudflare)ERR_SSL_VERSION_OR_…Cloudflare Origin CA not trusted — NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied) (Cloudflare)Cloudflare Origin C…SEC_ERROR_EXPIRED_CERTIFICATE — Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE (SSL / TLS)SEC_ERROR_EXPIRED_C…tlsv1 unrecognized name (SNI) — OpenSSL: SSL alert number 112 — tlsv1 unrecognized name (SSL / TLS)tlsv1 unrecognized …Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not establish…PKIX path building failed — javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target (Java)PKIX path building …Received fatal alert: handshake_failure — Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure (SSL / TLS)Received fatal aler…Keystore was tampered with, or password was incorrect — Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect (SSL / TLS)Keystore was tamper…SSLCertificateFile: file does not exist — Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty (SSL / TLS)SSLCertificateFile:…DNS problem: NXDOMAIN looking up A — Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain (SSL / TLS)DNS problem: NXDOMA…CAA record forbids issuance — Let's Encrypt/CA: CAA record for example.com prevents issuance (SSL / TLS)CAA record forbids …ssl_stapling ignored, no OCSP responder URL — Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem" (SSL / TLS)ssl_stapling ignore…certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate does no…

Directly related (8)

NET::ERR_CERT_COMMON_NAME_INVALIDSSL / TLS

NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain)

The certificate presented doesn’t include the hostname you visited — e.g. visiting www.example.com with a certificate only for ex…

curl: (60) SSL certificate problemSSL / TLS

curl: (60) SSL certificate problem: unable to get local issuer certificate

curl could not verify the server's certificate — missing CA, incomplete chain, self-signed or expired certificate.

error setting certificate verify locationsSSL / TLS

curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none

curl cannot read the CA bundle file it is configured to use — missing file, wrong path or permissions.

AH01909: server certificate does NOT include an ID which matches the server nameSSL / TLS

Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name

Apache's SSL virtual host name does not match any name inside the certificate it loads.

SSL_ERROR_BAD_CERT_DOMAINSSL / TLS

Firefox: Websites prove their identity via certificates — the certificate is only valid for other names. Error code: SSL_ERROR_BAD_CERT_DOMAIN

The certificate does not include the hostname you typed.

No subject alternative names presentSSL / TLS

Java: javax.net.ssl.SSLHandshakeException: No subject alternative names matching IP address 10.0.0.5 found

Java checks the hostname against the certificate's SANs and found no matching entry (for DNS names or IPs).

wildcard certificate does not cover a.b.example.comSSL / TLS

Browser: *.example.com certificate does not match a.b.example.com (ERR_CERT_COMMON_NAME_INVALID)

A wildcard certificate covers exactly one label: `*.example.com` matches `www.example.com` but not `a.b.example.com` or the bare…

CRYPT_E_NO_REVOCATION_CHECKSSL / TLS

curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate

Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.

Two steps away (21)

526Cloudflare

Cloudflare Error 526: Invalid SSL Certificate

With SSL mode Full (strict), the origin’s certificate is expired, self-signed, or doesn’t match the hostname.

ERR_CERT_AUTHORITY_INVALIDJavaScript

NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)

The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.

ERR_TLS_CERT_ALTNAME_INVALIDNode.js

Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames

The server’s certificate doesn’t cover the hostname you connected to.

unable to get local issuer certificateSSL / TLS

OpenSSL: error:num=20:unable to get local issuer certificate / SSL: CERTIFICATE_VERIFY_FAILED

The client could not build a chain from the server's certificate to a CA it trusts — the issuer is missing locally or the server…

DEPTH_ZERO_SELF_SIGNED_CERTSSL / TLS

Node/OpenSSL: Error: self signed certificate (code: DEPTH_ZERO_SELF_SIGNED_CERT)

The server presented a self-signed certificate (issuer equals subject), which no CA vouches for.

Timeout during connect (likely firewall problem)SSL / TLS

Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem)

The ACME validation server could not reach your server on port 80 within the timeout.

SELF_SIGNED_CERT_IN_CHAINnpm

npm ERR! code SELF_SIGNED_CERT_IN_CHAIN — request to https://registry.npmjs.org/ failed, reason: self signed certificate in certificate chain

A corporate proxy or antivirus is intercepting HTTPS, and npm doesn’t trust its certificate.

ERR_TOO_MANY_REDIRECTS (Cloudflare)Cloudflare

ERR_TOO_MANY_REDIRECTS with Cloudflare (Flexible SSL redirect loop)

The page redirects to itself forever — classic cause: Cloudflare SSL mode “Flexible” while the origin redirects HTTP to HTTPS.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cloudflare)Cloudflare

ERR_SSL_VERSION_OR_CIPHER_MISMATCH on a Cloudflare site (certificate not issued / multi-level subdomain)

Cloudflare has no edge certificate for the hostname — the Universal SSL cert is still pending, or the hostname is a second-level…

Cloudflare Origin CA not trustedCloudflare

NET::ERR_CERT_AUTHORITY_INVALID with a Cloudflare Origin Certificate (record not proxied)

Cloudflare Origin CA certificates are only trusted by Cloudflare — visitors reaching the origin directly (grey-cloud record, dire…

SEC_ERROR_EXPIRED_CERTIFICATESSL / TLS

Firefox: Peer's Certificate has expired. Error code: SEC_ERROR_EXPIRED_CERTIFICATE

Firefox found an expired certificate in the chain presented by the server.

tlsv1 unrecognized name (SNI)SSL / TLS

OpenSSL: SSL alert number 112 — tlsv1 unrecognized name

The server did not recognise the hostname sent in SNI and rejected the handshake (or an alert/warning is logged).

Could not establish trust relationship for the SSL/TLS secure channelSSL / TLS

.NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

A .NET client could not validate the server certificate or negotiate TLS, so the HTTPS call failed.

PKIX path building failedJava

javax.net.ssl.SSLHandshakeException: PKIX path building failed: unable to find valid certification path to requested target

Java doesn’t trust the server’s certificate chain (self-signed, corporate proxy CA, or missing intermediate).

Received fatal alert: handshake_failureSSL / TLS

Java: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

The server rejected the Java client's TLS offer — no shared protocol/cipher, SNI issue or a required client certificate.

Keystore was tampered with, or password was incorrectSSL / TLS

Java keytool: java.io.IOException: Keystore was tampered with, or password was incorrect

keytool or the JVM could not open the keystore — wrong password, wrong file type, or damaged file.

SSLCertificateFile: file does not existSSL / TLS

Apache: AH02240: Server should be SSL-aware but has no certificate configured / SSLCertificateFile: file '/etc/ssl/x.crt' does not exist or is empty

Apache cannot find the certificate or key file named in its configuration, or `SSLEngine on` is set without any certificate.

DNS problem: NXDOMAIN looking up ASSL / TLS

Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain

Let's Encrypt could not resolve the domain you asked a certificate for; no A/AAAA record exists.

CAA record forbids issuanceSSL / TLS

Let's Encrypt/CA: CAA record for example.com prevents issuance

The domain's DNS CAA records do not list the certificate authority you asked, so the CA must refuse.

ssl_stapling ignored, no OCSP responder URLSSL / TLS

Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem"

OCSP stapling is enabled but the certificate (or chain file) contains no OCSP responder, so nginx can't staple a response.

certificate does not have a private key (IIS)SSL / TLS

Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it

IIS cannot bind an HTTPS site because the imported certificate has no private key attached.

Map another error

Popular: 500403400ORA-009331064Critical errorFileNotFoundException assemblyTypeError