1. Record the exact URL or mail-server hostname, including any www prefix. A domain name, its subdomains and an IP address are different certificate identities.
2. Inspect the certificate's subject alternative names. Compare them with the requested hostname rather than relying on the certificate's friendly label.
3. Check the public DNS destination, including both IPv4 and IPv6 where present. Verify that every answering server has the intended website and certificate configuration.
4. If a CDN or security proxy answers first, inspect its certificate coverage and custom-hostname configuration.
5. Correct an accidental client hostname or server assignment. If the name is intentionally required but uncovered, arrange an appropriate certificate or reissue with the needed names.
6. Retest the original address and every redirect destination. Keep a valid certificate on an HTTPS address even when its only job is to redirect visitors.

From a trusted workstation, retrieve the website's public certificate and print its subject alternative names. Replace example.com with the hostname displaying the warning. The public certificate contains no private key, and this inspection does not change the site.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Read the result: Compare the exact browser hostname with the DNS names in subjectAltName. A certificate for www.example.com does not automatically cover example.com. A wildcard such as *.example.com covers an eligible single label beneath that domain, not every deeper name or the apex.

This extraction alone is not a complete trust-chain validation and hides handshake diagnostics for readability. Use a separate verified TLS check if it fails or if trust is also in doubt. Assign a certificate that covers the intended names at the actual TLS endpoint, then test again.

• Checking which names a wildcard certificate protects
• Adding or removing names from a multi-domain certificate
• Managing separate edge and origin certificates for a CDN
• Investigating a certificate warning in an email application

• DigiCert: Name Mismatch In Web Browser
• DigiCert: Troubleshooting Security Certificate Errors

• OpenSSL: TLS connection diagnostics
• OpenSSL: inspect an X.509 certificate