curl: (51) SSL: no alternative certificate subject name matches target host name
The certificate doesn't match the hostname
Seen in curl, Python (hostname doesn't match), Node.js (ERR_TLS_CERT_ALTNAME_INVALID)
The certificate the server sent does not list the name you connected to.
Common causes
- The certificate is missing this name (www vs apex, or a subdomain).
- The client connects by IP or an internal alias.
- SNI not sent, so the server returns its default certificate.
How to fix it
- Add the name to the certificate's subject alternative names.
- Connect using a name on the certificate.
- Make sure the client sends SNI (all modern clients do).
Got a different message? Paste it into the error explainer.
Related errors
- unable to get local issuer certificate · The client can't find the certificate's issuer
- unable to verify the first certificate · The intermediate certificate is missing
- certificate has expired · The server certificate has expired
- self signed certificate in certificate chain · The chain ends in an untrusted root
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate
- Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames · The certificate doesn't cover this hostname