X.509

SSL certificates fail to validate when the domain name in the certificate does not match the exact domain being visited, including subdomain variations (www vs. non-www). This hostname mismatch triggers trust errors for otherwise valid certificates.