When trying to navigate to a specific website (amazon.com in my case) I always get the "NET::ERR_CERT_COMMON_NAME_INVALID" error in Chrome (and equivalent errors in Safari/other browsers). When clicking to see the cert I can see that it's trying to associate it with the wrong website (register.be.xfinity.com instead of amazon.com) - see screenshot:

enter image description here

The background story is that my internet access modem was temporarily disabled and always routed all access to that xfinity "activation" website and I guess at some point I clicked approve to update the cert from that fake website. I tried removing the cert from keychain and adding it back (importing exported one and marking it as trusted) but it didn't help.

How can I fix the issue? Help!



Try changing your DNS.

Go to System Prefferences -> Network -> Advanced -> DNS

Then write down every DNS entry in case something goes wrong, and remove every DNS entry from the list.

Add at least two DNS servers. My favorite are Cisco ( and IBM (

Click Ok, then Apply.

Try visiting the website.

  • Thanks for the answer. I did what you said. Unfortunately that didn't fix the issue. I don't think it's a DNS issue but a bad cert. How do I reset the cert for a specific domain? – mindbomb Feb 3 at 18:48

This problem is not caused by you approving to "update" the certificate for that web site. You cannot "update" the certificate, nor can you "reset the cert for a specific domain" as you wrote in the comments. That's not really how it works.

What you have done is approve a specific certificate even though it doesn't validate according to normal rules. When you do that, you mark is a specifically trusted - but doing that does only just that, nothing else. It won't magically "use" that certificate for that site every time or anything like that at all. You will only get this prompt if the system you're communicating with presents that certificate.

As Amazon.com isn't presenting certificates from Xfinity, you're not actually communicating with Amazon, but with something or someone else.

This can be caused by a DNS issue, where a DNS server gives you false IP-addresses for amazon.com. This can be solved by using a different set of DNS-servers, unless you have something on your network or in your provider's network that is purposefully altering DNS answers. In that case you can consider switching to DNS over HTTPS (DoH) or DNS over TLS (DoT). You can enable DoH with a compatible set of servers in Chrome from the Settings page.

The problem could also be caused by your provider otherwise altering packets sent to you - by intercepting the raw network traffic and sending you bogus data. Try connecting through a mobile hot-spot or on someone else's WiFi to check if the site works there to be certain that it is a problem with your own internet connection.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .