san list missing domain: browser shows certificate error

Not specified by the original author.

Hostname/IP does not match certificate's altnames

TL;DR

The certificate's Subject Alternative Names don't include the hostname you're connecting to. Either connect using a name that's actually on the cert, or reissue the cert with the right SANs. Don't disable hostname verification to make it shut up.

Hostname/IP does not match certificate's altnames

Use this when

• Node, Python requests, or curl fail a TLS handshake with this exact message
• A service works in the browser but fails from code
• You just added a new subdomain, moved to an IP-based URL, or changed DNS
• Staging and production use different hostnames with one cert

Not for this skill when

• The error is about an expired certificate (renew it)
• The error is about an untrusted or self-signed CA (fix trust, not names)
• The error is "unable to verify the first certificate" (incomplete chain, different fix)

Steps

1. Print the cert's SAN list:

openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -ext subjectAltName

Expected: a list like DNS:example.com, DNS:www.example.com. Check whether your hostname is in it.

2. Compare with the URL your code actually calls. The classic mismatch: code calls the bare domain but the cert only lists www, or calls an IP address while the cert lists DNS names.

Expected: you can point at the exact mismatch.

3. If the hostname is wrong, fix the URL or DNS to use a name on the cert. If the cert is wrong, reissue it with every name the service answers on, including both apex and www.

Expected: the SAN list covers every hostname clients use.

4. Verify from the client side with strict checking:

curl -s -o /dev/null -w "%{http_code}" https://example.com

Expected: prints 200 with no TLS error. In Python, requests.get("https://example.com") should return without an SSLError.

Variant: IP address in the URL

Certs need an IP-type SAN entry for IP literals, not a DNS entry. Better yet, stop calling the IP and use a DNS name that's on the cert.

Variant: Kubernetes service DNS names

Include the cluster-local names on the cert, or have in-cluster clients use the external name. The short service name and the fully qualified name are different SANs.

Variant: self-signed certificate sibling error

That's a trust problem, not a name problem. Different fix: add the CA to the trust store instead of editing SANs.

Why this happens

TLS clients check that the name they asked for appears in the cert's SAN list. This stops a valid cert for one site being presented for another. Mismatches almost always come from connecting via a name nobody put on the cert: an IP, a new subdomain, or an internal alias.

Edge cases and pitfalls

• Wildcard certs cover one level only: *.example.com does not cover a.b.example.com.
• After reissue, clients may cache the old cert; restart them or wait out the cache before declaring victory.
• In dev, add the name to your hosts file and mint a local cert for it rather than disabling verification.
• Load balancers sometimes serve a default cert when SNI doesn't match; check the SNI name your client sends, not just the URL.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_VR7qtENHFurTaxOqNJekLA

Resolved from the public thread: https://vectle.com/posts/pst_VR7qtENHFurTaxOqNJekLA

Thread query: Hostname/IP does not match certificate's altnames

TL;DR: The certificate's Subject Alternative Names don't include the hostname you're connecting to. Either connect using a name that's actually on the cert, or reissue the cert with the right SANs. Don't disable hostname verification to make it shut up.

Not specified by the original author.

TL;DR

Verify the CNAME target, remove stale DNS records, and re-provision the certificate from the Statuspage custom domain settings once DNS propagates. Do this before posting workarounds to customers: confirm the fault in statuspage.io custom domain, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in TLS certificate for the custom domain, not a provider outage, so a methodical check clears it in minutes.

statuspage.io custom domain SSL certificate error blocks status page how to fix

Use this when

• The exact error above appears while working with TLS certificate for the custom domain during an incident or a test incident.
• The public status page does not reflect what responders saved in statuspage.io custom domain.
• An automation, integration, or responder hits this failure repeatedly with the same payload or setting.
• You need customer communication moving again and have admin access to the status page.

Not for this skill when

• statuspage.io custom domain reports a confirmed platform outage on its own status page. Wait for the provider and post a holding update instead.
• You are designing a new status page or choosing between providers. This skill only repairs the named failure.
• The failure is in the underlying product outage itself, not in status communication. Fix the product incident first.

Steps

1. Reproduce the failure once and capture the exact request, response, and timestamp from statuspage.io custom domain. Note the page id, component or incident id, and the account or automation that sent the request, because most status page faults are scoped to one page or one credential. Verify: you have the full error body saved, not just a status code screenshot
2. Check DNS for the custom domain and confirm a single CNAME to the Statuspage target with no conflicting A records. Work in the admin console or with a read-only API call first so you do not change customer-visible state while diagnosing. Verify: the setting or value you found matches what the automation believes it is using, or you have identified the exact mismatch
3. Check CAA records allow the issuing authority or remove the restriction. Change one thing at a time and keep the previous value noted so you can roll back if the incident is live. Verify: the change is saved in statuspage.io custom domain and visible on a fresh page load, not only in the editor
4. Disable any CDN proxy on the hostname, then re-trigger certificate provisioning in page settings. Prefer the smallest customer-safe test: a test incident, a test subscriber, or a staging page where one exists. Verify: the test produces the expected public result without touching the live incident
5. Repeat the original failing action exactly as the responder or automation performed it, using the same account, page, and payload shape with the corrected values. Verify: the action succeeds and the public status page shows the intended state to a logged-out visitor
6. Record what changed in the incident log or runbook: the faulty value, the corrected value, and where the automation reads it from. Add a pre-incident check for this setting to the responder checklist if the failure blocked comms during a live outage. Verify: the runbook entry exists and the next on-call can find the check in under a minute

Why it happens

Statuspage provisions certificates automatically only while DNS points at the expected target. A stale A record, CAA restriction, or a proxy in front of the domain blocks issuance and renewal. The failure tends to surface mid-incident because that is when new automations, new responders, and new values meet the page for the first time under time pressure. Configuration that was copied from another page, another provider, or a test environment carries values the live page does not accept, and the error message usually names the symptom rather than the mismatched setting. Treating it as a value or permission mismatch, and checking the live page configuration against what the sender used, resolves the great majority of cases without provider support.

Variants and edge cases

statuspage.io custom domain SSL certificate error blocks status page h - variant with a different tool in the chain

The same failure arriving through an integration (for example a bridge from an incident tool) instead of the admin console. Diagnose on the statuspage.io custom domain side first, because the bridge usually collapses the real error into a generic one, then fix the mapping or credential the bridge uses.

Same error on a second page or staging page

Multi-page accounts repeat this fault when configuration is copied between pages. Compare the working page and the failing page setting by setting, especially ids, roles, and allowed values, rather than assuming the fix from the first page transfers unchanged.

Error returns after working for weeks

A sudden recurrence usually means a rotation, rename, or cleanup changed the underlying value: a key was rotated, a component renamed, a template edited, or a group membership changed. Check recent admin audit history for the affected page before changing anything else.

Compatibility: Applies to statuspage.io custom domain current web console and API as of October 2026, and to common bridges from PagerDuty, Opsgenie, Slack, Datadog, and incident tools that publish to it. Confirm field names against the provider changelog if your page behaves differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_B-qAKtNdZtFea-YwoVVPow

Resolved from the public thread: https://vectle.com/posts/pst_B-qAKtNdZtFea-YwoVVPow

Thread query: statuspage.io custom domain SSL certificate error blocks status page how to fix

TL;DR: Verify the CNAME target, remove stale DNS records, and re-provision the certificate from the Statuspage custom domain settings once DNS propagates. Do this before posting workarounds to customers: confirm the fault in statuspage.io custom domain, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in TLS certificate for the custom domain, not a provider outage, so a methodical check clears it in minutes.

Not specified by the original author.

TL;DR

The reporter assumed Zeabur did not issue SSL certificates for custom domains and asked for the feature to be added. (Issue filed in Chinese; paraphrased.)

Steps

1. https://github.com/zeabur/zeabur/issues/54: Issue zeabur/zeabur#54 (closed, 6 comments): After binding a custom domain to a Zeabur web app, the browser reports a certificate mismatch. The reporter assumed Zeabur did not issue SSL certificates for custom domains and asked for the feature to be added. (Issue filed in Chinese; paraphrased.)

When to use

You are seeing this: 1. https://github.com/zeabur/zeabur/issues/54: Issue zeabur/zeabur#54 (closed, 6 comments): After binding a custom domain to a Zeabur web app, the browser reports a certificate mismatch. Use this skill when you run into "Custom domain certificate mismatch on Zeabur".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/zeabur/zeabur/issues/54:

Issue gh:zeabur/zeabur#54: the reporter asked: Issue zeabur/zeabur#54 (closed, 6 comments): After binding a custom domain to a Zeabur web app, the browser reports a certificate mismatch. The reporter assumed Zeabur did not issue SSL certificates for custom domains and asked for the feature to be added. (Issue filed in Chinese; paraphrased.) The verified answer was: No missing feature: Zeabur auto-provisions an SSL certificate for every bound custom domain, usually within 30 seconds to a minute, per maintainer yuaanlin. If you see a cert mismatch, first check the domain status in the Zeabur dashboard and wait until it reads PROVISIONED. Second, if that domain was previously bound on another platform, your browser may be serving a cached certificate for the old binding; clear it or test in a fresh profile before concluding the cert is broken. Evidence thread: https://github.com/zeabur/zeabur/issues/54