A visitor opens a valid site address but the browser reports that the certificate belongs to another name. Because hostname verification happens during TLS, a WordPress redirect cannot correct the error.
Decide which hostnames the site must accept, make each one TLS-valid, and only then redirect alternate names to the canonical address.
What it means
A name mismatch occurs when the requested hostname is absent from the certificate Subject Alternative Name list, or when the server presents the wrong certificate for that SNI name. The certificate must match before the browser sends an HTTP request.
A wildcard covers only the level it represents. For example, a wildcard for subdomains does not automatically cover the apex domain or a deeper nested name.
A realistic WordPress example
Visitors to shop.example.comreceive a certificate issued only for example.com. The CDN alias points to a default virtual host, so the redirect from the shop hostname to the apex never runs.
Adding the required name to the certificate and binding it to that CDN hostname fixes TLS. The HTTP redirect can then send visitors to the canonical address safely.
Why it matters and when to use it
A mismatch is an identity failure, not a cosmetic warning. Ignoring it or disabling hostname checks can expose visitors and integrations to impersonation.
Use this diagnosis when the browser names the wrong host, when only one subdomain fails, or when behavior differs between IPv4, IPv6, the CDN, and the origin.
A straightforward route for beginners
- Copy the exact hostname from the failing URL.
- Inspect the certificate served for that hostname and compare its SAN list.
- Check the apex,
www, and every public subdomain separately. - Confirm that DNS and CDN aliases point to a service configured for that name.
- Issue or select a certificate containing the required hostnames and bind it to the correct listener.
- After TLS succeeds, test the canonical redirect and a deep URL.
The advanced route
Query every active IPv4 and IPv6 address with the intended SNI value. Compare the presented serial, SANs, chain, virtual-host selection, and edge-to-origin path. A no-SNI request can help identify the default certificate, but it is not a substitute for the real client path.
Keep certificate coverage deliberate. Include only hostnames the service owns, configure strict default-host behavior, and confirm OAuth callbacks, webhooks, cookies, and sitemap URLs after canonicalization. A deliberately unsupported hostname should not expose another tenant or site.
Risks, common mistakes, backup, and rollback
Do not assume that a wildcard covers every hostname, and do not rely on a redirect to fix a pre-HTTP error. Loose default virtual hosts can expose the wrong certificate or application.
Save existing DNS records, CDN mappings, certificates, and listener bindings before changing them. If a new certificate or route disrupts a working hostname, restore its previous binding while you correct the intended host mapping.
How AIOWS helps:
AIOWS SSL Manager
AIOWS SSL Manager can help inspect supported WordPress-side HTTPS settings after each accepted hostname completes TLS successfully. It is useful for checking that WordPress uses the intended canonical address and serves application paths correctly over HTTPS.
Certificate issuance, SAN coverage, DNS aliases, SNI routing, and CDN or server bindings are external controls. AIOWS cannot make an uncovered hostname valid or select the correct certificate at the edge.
Once infrastructure is fixed, use SSL Manager to review the WordPress URLs and test redirects, administration, assets, forms, and callbacks. Keep the hostname tests themselves outside WordPress so every public address and active network path is covered.
Related AIOWS articles
- How to Install SSL on a WordPress Site
- SSL Handshake Failed on WordPress: Causes and Fixes
- WWW vs Non-WWW HTTPS Redirects in WordPress
Conclusion and recommended route
Give every supported hostname valid certificate coverage and the correct SNI binding before applying HTTP redirects. Then canonicalize alternate names and reject hostnames the service does not own.
