How to Fix ‘NET::ERR_CERT_COMMON_NAME_INVALID’ in Google Chrome

Navigating to a website in Google Chrome only for the browser to block access with the warning: “Your connection is not private” and error code: NET::ERR_CERT_COMMON_NAME_INVALID prevents secure web browsing. In modern web standards, HTTPS establishes an encrypted TLS session by validating that the server’s SSL certificate matches the exact Fully Qualified Domain Name (FQDN) in the browser address bar. When a certificate’s Common Name (CN) or Subject Alternative Names (SAN) do not align with the requested URL, an outdated DNS record points to a shared hosting IP, or a third-party antivirus proxies SSL connections incorrectly, Chrome terminates the TLS handshake. This tutorial outlines how to diagnose SSL certificate mismatches, flush local SSL state caches, and resolve this connection error.

What Triggers NET::ERR_CERT_COMMON_NAME_INVALID?

Chrome halts connection progress whenever public-key cryptography fails domain identity verification:

• Domain Name Mismatch: The certificate was issued to example.com but the user accessed www.example.com without matching SAN declarations.
• Stale Local DNS and Host Cache: Outdated IP mappings routing traffic to an old server hosting a different website’s SSL certificate.
• Third-Party Antivirus HTTPS Scanning: Security software intercepting web traffic with a locally generated proxy certificate that Chrome rejects.
• Corrupted Windows SSL State: Damaged X.509 certificate revocation lists (CRL) stored in the local Schannel cache.
• Public Wi-Fi Captive Portals: Network gateways attempting to hijack HTTPS requests to display login or agreement pages.

Method 1: Check the Certificate Subject Alternative Names (SAN)

Verifying which domains the certificate legitimately covers reveals whether the error is client-side or server-side.

1. On the warning page in Google Chrome, click the red Not secure badge in the address bar.
2. Click Certificate is not valid (or Certificate invalid).
3. In the Certificate Viewer window, click the Details tab.
4. Scroll down and select Extension: Subject Alternative Name.
5. Inspect the DNS names listed. If you visited subdomain.example.com but the SAN list only covers example.com, the website administrator must re-issue the certificate with wildcard coverage.

Method 2: Clear the Windows SSL State

Purging cached TLS session tickets and local certificates resolves stale authentication records.

1. Press Win + R, type inetcpl.cpl, and press Enter to launch Internet Properties.
2. Navigate to the Content tab.
3. Click the Clear SSL state button.
4. Wait for the confirmation message stating: “The SSL certificate cache was successfully cleared.”
5. Click OK, restart Google Chrome, and reload the webpage.

Method 3: Flush Local DNS Cache and Chrome Host Resolver

Stale DNS entries frequently point users to old hosting IP addresses bearing obsolete SSL certificates.

1. In Chrome, type chrome://net-internals/#dns into the address bar and press Enter.
2. Click the Clear host cache button.
3. Next, press Win + X and select Terminal (Admin) or Command Prompt (Admin).
4. Enter the following command and press Enter:

   ipconfig /flushdns

5. Restart your browser and re-test connection.

Method 4: Disable Third-Party Antivirus HTTPS Scanning

Many third-party security suites (such as Avast, AVG, or Bitdefender) inspect encrypted HTTPS traffic by creating local proxy certificates.

1. Open your third-party antivirus software dashboard.
2. Navigate to Web Protection or Real-time Protection settings.
3. Locate options such as Enable HTTPS scanning or Scan secure connections and toggle them off temporarily.
4. Refresh Google Chrome to determine whether the certificate error clears.

Method 5: Check System Clock and Time Zone

SSL certificates contain strict Not Before and Not After validity timestamps:

1. Right-click the clock in the bottom-right corner of the taskbar and select Adjust date and time.
2. Toggle on Set time automatically and Set time zone automatically.
3. Click Sync now under Additional settings.