Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames
The certificate doesn't cover this hostname
Seen in Node.js, npm, axios, node-fetch, Electron apps
Node.js received a valid certificate, but the hostname or IP you connected to is not in its subject alternative names.
Common causes
- The certificate covers the apex but not www, or a different subdomain.
- Connecting by IP address or an internal alias that is not on the certificate.
- The server returned its default certificate because SNI or the Host was wrong, or a proxy presents its own certificate.
How to fix it
- Compare "Host:" and "DNS:" names in the error message; reissue the certificate with the missing name.
- Connect using a name the certificate covers.
- If you set a custom servername option or Host header, make sure it matches the certificate.
Got a different message? Paste it into the error explainer.
Related errors
- unable to get local issuer certificate · The client can't find the certificate's issuer
- unable to verify the first certificate · The intermediate certificate is missing
- certificate has expired · The server certificate has expired
- self signed certificate in certificate chain · The chain ends in an untrusted root
- curl: (51) SSL: no alternative certificate subject name matches target host name · The certificate doesn't match the hostname
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate