| Previous | Next |
| WININET_E_SEC_CERT_DATE_INVALID | WININET_E_HTTP_TO_HTTPS_ON_REDIR |
WININET_E_SEC_CERT_CN_INVALID
WININET_E_SEC_CERT_CN_INVALID means that the host name requested by the client does not match the identity presented in the TLS server certificate. Microsoft describes the typical case as requesting one hostname while the certificate identifies a different hostname.
Common causes
- Connecting by an IP address or alias that is not covered by the certificate.
- Incorrect virtual-host or SNI configuration on the server.
- A proxy or interception product presenting its own certificate.
- A redirect that changes the target hostname unexpectedly.
Safe resolution
Use the canonical hostname that the certificate covers, deploy a certificate with the required DNS names, or correct the proxy trust model. Do not enable the ignore-name-mismatch flag as a production workaround.
Microsoft: HttpOpenRequest security flags · Microsoft: InternetErrorDlg
Looking for a different code? Search another status or error code.