net::err_cert_common_name_invalid

Tested in a ShoHost sandbox on 12 October 2026: Apache 2.4 with mod_ssl on Debian, captured with headless Chrome. We made our own test certificate authority, trusted it only inside a throwaway Chrome profile, and served three broken certificates on purpose: one that doesn’t cover a subdomain, one that expired, and one that is self-signed….