unrecognized_name
unrecognized_name (112) is sent when the server does not recognize the hostname sent in the SNI (Server Name Indication) extension. The server has no certificate for the requested hostname. In TLS 1.3 this is typically fatal; in TLS 1.2 servers may send it as a warning and continue with a default certificate.
Alert Code
112
Level
Warning
Standard
RFC 8446
Description
SNI (Server Name Indication, RFC 6066) allows a server hosting multiple domains to select the correct certificate based on the hostname in the ClientHello. If the server receives an SNI hostname it has no certificate for, it sends unrecognized_name. Behavior varies: Nginx returns a default certificate and continues; strict servers abort. In TLS 1.3, unrecognized_name is fatal per RFC 8446. This alert is important for multi-tenant hosting where certificate coverage for all hostnames must be maintained.
Common Causes
- –Client SNI hostname not matching any certificate on the server
- –Wildcard certificate not covering the specific subdomain requested
- –Server certificate deployment lag after DNS change
- –SNI bypass attempt (connecting to IP without matching hostname)