Certificate Error - Subject Alternative Name

Question

Dear,

We are receiving the following message/error!!!.

It is a Default Web Site in a IIS.

In different forums, it is indicated that the error is because the URL names to be resolved in the certificate do not match.

How do we verify this on the Certificate?

The department that generates the certificate informs us that everything is correct.

We need to obtain evidence that they are mistaken.

Please, can you help us?

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the details.

Based on the information provided, the error shown in the screenshot is not sufficient evidence of a Subject Alternative Name (SAN) mismatch by itself. The browser is reporting ERR_CONNECTION_RESET, which indicates that the TCP/TLS connection was terminated before the page could be loaded. This behavior can be caused by IIS, a firewall, a load balancer, a reverse proxy, SSL/TLS configuration issues, or certificate-related problems.

However, if you want to determine whether the certificate matches the URL being accessed, you can verify the certificate directly.

1. Verify the Certificate SAN

• Open the site in a browser.
• Select the padlock or certificate information.
• Open Certificate → Details.
• Locate Subject Alternative Name.
• Verify that the hostname being accessed is listed.

In your example, the URL is:

https://uwhteamweb001.appdom.app.telecom.com.ar

The certificate should contain either:

DNS Name = uwhteamweb001.appdom.app.telecom.com.ar

or a wildcard SAN that covers the hostname, such as:

DNS Name = *.appdom.app.telecom.com.ar

Modern browsers validate the hostname against the Subject Alternative Name (SAN) extension rather than the certificate's Friendly Name displayed in Windows or IIS. Therefore, a certificate can appear valid in IIS while still generating name-related browser warnings if the requested hostname is not included in the SAN list.

2. Check the Certificate on the IIS Server

On the IIS server, open:

certlm.msc

Navigate to:

Certificates (Local Computer) -> Personal -> Certificates

Open the certificate bound to the HTTPS site and review:

• Subject
• Subject Alternative Name
• Enhanced Key Usage (should include Server Authentication)

You can also use the following command to display certificate details:

certutil -store my

Then review the SAN entries in the output.

3. Verify the IIS Binding

In IIS Manager:

• Select Default Web Site.
• Choose Bindings...
• Edit the https binding.
• Confirm that the expected certificate is selected.

It is also recommended to verify that the HTTPS binding is correctly configured and associated with the intended certificate.

4. Important Note

If the certificate does not contain the hostname shown in the URL, this is clear evidence that the certificate was not issued correctly for that site.

If the hostname is present in the SAN list, then the certificate itself is unlikely to be the cause of the issue, and the ERR_CONNECTION_RESET error is more likely related to one of the following:

• TLS protocol or cipher suite mismatch
• Firewall or load balancer resetting the connection
• Incorrect IIS binding configuration
• SSL inspection or security device interference
• Application-level connection termination

Therefore, the first step is to export or inspect the certificate and compare the requested URL against the SAN entries. This provides objective evidence to determine whether a certificate name mismatch exists or whether the issue lies elsewhere.

I hope this information helps. If you find the response useful, please click Accept Answer.

Thank you for using Microsoft Q&A.