# A Certificate for Another Host Name

A certificate for another host name: valid is false with "Hostname mismatch" for wrong.host.badssl.com.

Source: https://docs.deepinfo.com/reference/lookup/ssl/examples/wrong-host/

Last updated: 2026-09-24

---
`GET https://api.deepinfo.com/v1/lookup/ssl?target=wrong.host.badssl.com`

A certificate for another host name: valid is false with "Hostname mismatch" for wrong.host.badssl.com.

Example 4 of 4 in **Certificate Problems** · [SSL Certificate Examples](/reference/lookup/ssl/examples/) · endpoint: [SSL](/reference/lookup/ssl/)

Tags: `param` `target` · `value` `wrong.host.badssl.com`

Asks for the certificate of `wrong.host.badssl.com`.

The certificate is a valid Let's Encrypt certificate for `*.badssl.com` and `badssl.com`, but a wildcard covers only one label, so it does not cover `wrong.host.badssl.com`. `signature.valid` is `false` and `invalid_reason` reads `Hostname mismatch, certificate is not valid for 'wrong.host.badssl.com'.`.

## Request

| Parameter | In | Value |
|---|---|---|
| `target` | query | `wrong.host.badssl.com` |

```bash
curl 'https://api.deepinfo.com/v1/lookup/ssl?target=wrong.host.badssl.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'
```

## Response

### 200 · OK

`Content-Type: application/json` · `ratelimit-limit: 100` · `ratelimit-remaining: 92` · `ratelimit-reset: 1` · `x-ratelimit-limit-minute: 100` · `x-ratelimit-remaining-minute: 92` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a`

```json
{
  "target": "wrong.host.badssl.com",
  "port": 443,
  "check_date": "2026-09-24T07:52:00Z",
  "connection_status": "success",
  "parsed": {
    "version": {
      "name": "v3",
      "value": "2"
    },
    "fingerprint_sha1": "4bd165a7314a7f1af311ca06b361136c5e4b23fc",
    "fingerprint_sha256": "688f99185e12a494d3910ce060532826a35fe02476e17e9bad2f68e923847ca3",
    "fingerprint_md5": "96e8a26ad116786b0a25971acb8927c5",
    "subject": {
      "dn": "CN=*.badssl.com",
      "common_name": "*.badssl.com",
      "country_name": null,
      "locality": null,
      "organization": null,
      "organizational_unit": null,
      "state": null
    },
    "signature": {
      "value": "KdAJTclDuCaC9jK30mkQlPKn1V7rHbnYF1EhlixCpL+o/V4Q2wxynXzk432Yn9LhO6oro17jYubSCH3iXpcifQ5eRJtpEiHQzOyRbjdyOx3eYg2axuv31bz/iA/JVG9nt7ARuzjInzMDZBhwMtbvlDZIjuLviAQo5dJryGgkQIQ+jId6/P9BOZsJa/MZWMOUYbiJwtfU9ON4iH7Q23iDfOWaemfjLoHb15yFE7B9HhRVDG306qYeFfUMJ9GwsWNpnaD+1N6Yw6QiPa0q9joGuuChwNHoxg24vSqEDQlm4N/P28vcdEuH8F1ml06lNPa/NKmiAVDNTAmPPSwOZxj58g==",
      "self_signed": false,
      "valid": false,
      "valid_chain": true,
      "invalid_reason": "Hostname mismatch, certificate is not valid for 'wrong.host.badssl.com'.",
      "signature_algorithm": {
        "oid": "1.2.840.113549.1.1.11",
        "name": "sha256"
      }
    },
    "validity": {
      "start": "2026-07-28T20:03:02Z",
      "length": 7775999,
      "end": "2026-10-26T20:03:01Z"
    },
    "issuer": {
      "dn": "CN=YR2,O=Let's Encrypt,C=US",
      "common_name": "YR2",
      "country_name": "US",
      "locality": null,
      "organization": "Let's Encrypt",
      "organizational_unit": null,
      "state": null
    },
    "extensions": {
      "key_usage": {
        "digital_signature": true,
        "content_commitment": false,
        "key_agreement": false,
        "data_encipherment": false,
        "key_encipherment": true,
        "key_cert_sign": false,
        "crl_sign": false
      },
      "extended_key_usage": {
        "server_auth": true
      },
      "basic_constraints": {
        "is_ca": false
      },
      "subject_key_identifier": {
        "digest": "dq8D8ru6IYm7s2jqVCgw6zmnFnU="
      },
      "authority_key_identifier": {
        "key_identifier": "QBUtJnntMiCe35pyHdYyH4EMgQw="
      },
      "authority_info_access": {
        "caissuers_urls": "http://yr2.i.lencr.org/"
      },
      "subject_alt_name": {
        "dns_names": [
          "*.badssl.com",
          "badssl.com"
        ]
      },
      "certificate_policies": [
        "2.23.140.1.2.1"
      ],
      "crl_distribution_points": [
        "http://yr2.c.lencr.org/126.crl"
      ],
      "signed_certificate_timestamp": [
        {
          "log_id": "lE5Dh/rswe+B8xkkJqgYZQHH0184AgE/cmd9VTcuGdg=",
          "timestamp": 1785272492,
          "version": 0,
          "signature": "MEUCIFex5q/Y0IBkHkQyKep68fhRUwuZ2SVEEAYncT6rIT40AiEA3lwnkwd9ceT5cs0HdGaey3W/6HN9H/yWcTjQWJMbvi4="
        },
        {
          "log_id": "bP5QGUOoXqkWvFLRM+TcyR7xQRx9JYQg0XOAnhgY6zo=",
          "timestamp": 1785272492,
          "version": 0,
          "signature": "MEYCIQCkFMBNvc7IZKPP0LtfFnfvf9UUNeJGlP7OnH/qyaXHqAIhANbj30XMrPLmiTnxKq0EIneGF3jeexb90azDwFreJkda"
        }
      ],
      "other_extensions": []
    },
    "serial_number": "553939127019353777130095224212727712045181",
    "tbs_fingerprint": "15f3242aaa24d13df70f702b1eacf227368bd5e1a349f3b5cb1ce0640f0b4423",
    "subject_key_info": {
      "fingerprint": {
        "hash_algorithm_name": "sha256",
        "value": "688f99185e12a494d3910ce060532826a35fe02476e17e9bad2f68e923847ca3"
      },
      "key_algorithm": {
        "name": "RSA"
      },
      "rsa_public_key": {
        "length": "2048",
        "modulus": "c54475a35dd13620a75676ed3e299a43106eda77a3f87658c54f1528e73e5a3b8cdaaa6b593fdb81ae422799023c08e2bc580ce9925768a0ccf9dc6be2ca6936e05b255b16467d4ca6c233612a4422c70c3e0dd19384b029a09293b508a3b9d7687b2de9aa310ac02b5ebcacb6e88214cd6d1f3cc5eb9743c749882524ca4238d1e9dcddd289e4a17f6d7f2185c4ef2069edcc33cdd18a0a4db42bac8aaaceab86281a00153248e088a00250e5779740b961dc7e6d2784e453f972c374ad01d82590238a56618836116d1872f78ebfeae6e6e60c6d75936bb1974dc981f247e9253f0b49893bffaa582f81539eaa980d915f1f2379e930c6f3d71153f2cdcaaf",
        "exponent": "65537"
      }
    },
    "has_expired": false,
    "fqdn_list": [
      "badssl.com"
    ]
  },
  "certificate": "MIIFADCCA+igAwIBAgISBlvhezWdMPyllFn5iTIxwdh9MA0GCSqGSIb3DQEBCwUAMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZUjIwHhcNMjYwNzI4MjAwMzAyWhcNMjYxMDI2MjAwMzAxWjAXMRUwEwYDVQQDDAwqLmJhZHNzbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFRHWjXdE2IKdWdu0+KZpDEG7ad6P4dljFTxUo5z5aO4zaqmtZP9uBrkInmQI8COK8WAzpkldooMz53Gviymk24FslWxZGfUymwjNhKkQixww+DdGThLApoJKTtQijuddoey3pqjEKwCtevKy26IIUzW0fPMXrl0PHSYglJMpCONHp3N3SieShf21/IYXE7yBp7cwzzdGKCk20K6yKqs6rhigaABUySOCIoAJQ5XeXQLlh3H5tJ4TkU/lyw3StAdglkCOKVmGINhFtGHL3jr/q5ubmDG11k2uxl03JgfJH6SU/C0mJO/+qWC+BU56qmA2RXx8jeekwxvPXEVPyzcqvAgMBAAGjggIoMIICJDAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUdq8D8ru6IYm7s2jqVCgw6zmnFnUwHwYDVR0jBBgwFoAUQBUtJnntMiCe35pyHdYyH4EMgQwwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veXIyLmkubGVuY3Iub3JnLzAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLwYDVR0fBCgwJjAkoCKgIIYeaHR0cDovL3lyMi5jLmxlbmNyLm9yZy8xMjYuY3JsMIIBDQYKKwYBBAHWeQIEAgSB/gSB+wD5AHYAlE5Dh/rswe+B8xkkJqgYZQHH0184AgE/cmd9VTcuGdgAAAGfqohgFAAABAMARzBFAiBXseav2NCAZB5EMinqevH4UVMLmdklRBAGJ3E+qyE+NAIhAN5cJ5MHfXHk+XLNB3Rmnst1v+hzfR/8lnE40FiTG74uAH8AbP5QGUOoXqkWvFLRM+TcyR7xQRx9JYQg0XOAnhgY6zoAAAGfqohjwQAIAAAFABgjq+UEAwBIMEYCIQCkFMBNvc7IZKPP0LtfFnfvf9UUNeJGlP7OnH/qyaXHqAIhANbj30XMrPLmiTnxKq0EIneGF3jeexb90azDwFreJkdaMA0GCSqGSIb3DQEBCwUAA4IBAQAp0AlNyUO4JoL2MrfSaRCU8qfVXusdudgXUSGWLEKkv6j9XhDbDHKdfOTjfZif0uE7qiujXuNi5tIIfeJelyJ9Dl5Em2kSIdDM7JFuN3I7Hd5iDZrG6/fVvP+ID8lUb2e3sBG7OMifMwNkGHAy1u+UNkiO4u+IBCjl0mvIaCRAhD6Mh3r8/0E5mwlr8xlYw5RhuInC19T043iIftDbeIN85Zp6Z+MugdvXnIUTsH0eFFUMbfTqph4V9Qwn0bCxY2mdoP7U3pjDpCI9rSr2Oga64KHA0ejGDbi9KoQNCWbg38/by9x0S4fwXWaXTqU09r80qaIBUM1MCY89LA5nGPny",
  "parse_errors": []
}
```

## Related Examples

- [An Untrusted Root](/reference/lookup/ssl/examples/untrusted-root/)
- [A Self-Signed Certificate](/reference/lookup/ssl/examples/self-signed/)
- [An Expired Certificate](/reference/lookup/ssl/examples/expired/)
- [A Host Name That Does Not Resolve](/reference/lookup/ssl/examples/not-resolved/)
- [A Port Without TLS](/reference/lookup/ssl/examples/no-tls-on-port/)
- [An Elliptic Curve (ECDSA) Key](/reference/lookup/ssl/examples/ecdsa-key/)