Skip to content
MtrXTools

x509: certificate is valid for X, not Y

The certificate doesn't cover this hostname

Seen in Go (crypto/x509), Docker, Kubernetes tools, Terraform

Go received a certificate that does not include the hostname or IP it connected to; the error lists the names it does cover.

Common causes

  • The certificate is for a different name, often www versus apex or another subdomain.
  • Connecting by IP to a certificate without IP SANs.
  • A certificate with only a common name: Go ignores the CN and requires SANs.
  • The server returned its default certificate for an unconfigured name.

How to fix it

  1. Compare the names after "valid for" with the host you dialled.
  2. Reissue the certificate with the missing DNS name or IP in its SANs.
  3. Connect using a name the certificate covers, or set tls.Config ServerName to it.
See the names on the certificate

Got a different message? Paste it into the error explainer.

Related errors

All 32 Languages & runtimes errors