When a browser reports the certificate presented doesn't match the domain being visited, and you're confident the correct certificate is installed somewhere on the server, this usually means an SNI (Server Name Indication) misconfiguration — the server isn't correctly matching the incoming hostname to the right certificate among several installed on the same server/IP.
The fix
Review your web server's virtual host / server block configuration to confirm each site's certificate is correctly scoped to its own hostname-matching block, rather than one block inadvertently matching (and serving its certificate for) requests intended for a different hostname on the same server.
What typically causes a server to serve a completely unexpected, unrelated certificate
This usually points to an SNI misconfiguration on a server hosting multiple sites, a load balancer or CDN routing to the wrong backend, or in rarer cases, DNS pointing to infrastructure you don't actually control — checking which certificate is expected versus what's actually served, using the techniques in our dedicated 'check which certificate a server serves' guide, isolates the specific cause.
How to distinguish a routing issue from a genuinely fraudulent certificate
Checking Certificate Transparency logs for your own domain confirms whether the unexpected certificate was actually issued by a CA on your organization's behalf (suggesting a routing or configuration issue) or represents something genuinely unauthorized — a meaningful distinction determining whether this is a quick configuration fix or a security incident requiring the revocation process covered elsewhere on this site.
What DNS-level checks help rule out a routing issue as the cause
Confirming your domain's DNS records actually point to the server or infrastructure you expect, using a direct DNS lookup tool, rules out the possibility that DNS itself is routing you to unrelated infrastructure serving its own, entirely different certificate.
How to report a suspected fraudulent certificate if routing and DNS both check out correctly
If DNS and routing both appear correct yet an unexpected certificate persists, searching Certificate Transparency logs for your domain and reporting any genuinely unauthorized certificate directly to the issuing CA (most publish a dedicated abuse reporting process) is the appropriate next step.
A final note for multi-tenant infrastructure operators
If you operate infrastructure serving many different domains or tenants, periodically auditing that each one serves its own correct, expected certificate — rather than only investigating reactively when a specific report comes in — catches a misconfiguration before it affects a meaningful number of visitors.
What tools help you check DNS resolution independently of your own local cache
Using a DNS lookup tool that queries public resolvers directly, rather than relying on your own system's potentially cached DNS results, confirms exactly where your domain is currently, actually pointing according to the broader internet, not just according to what your own machine currently has cached.
How to methodically rule out each possible cause in the correct order
Checking DNS resolution first (since an incorrect DNS destination explains everything downstream), then checking server-side SNI configuration, then checking for CDN or proxy routing issues, works through the most likely causes in a logical, efficient sequence rather than jumping between possibilities randomly.
A quick closing checklist
A quick closing checklist covers checking which certificate is actually being served with a direct OpenSSL check, confirming DNS points where you expect, and checking Certificate Transparency logs if a genuinely unauthorized certificate is suspected rather than a routing issue.
What role browser extensions can play in causing an apparently wrong certificate to display
Certain browser extensions, particularly ones that modify network requests or inject their own content, can occasionally interfere with certificate display in confusing ways — testing with extensions disabled rules out this specific, less commonly considered variable.