hostname of the 1st certificate does not match 'kid'

[AleksCee]

I build a BOT using the "webex-node-bot-framework" and it works fine with my private account. I change the bot key to the bot I created for the corporate space and the framework starts up OK. Websocket connections are OK. But when the first message is sent to the bot, the app panics with the error "Hostname of 1st certificate does not match 'kid'" - I don't understand why this happens. What are the differences between using websocket in "public" or "corporate" spaces? Can a company use other certificates? Isn't the websocket connection established only to the Webex network? How can I fix this without security issues?
Thanks, Alex

[sreenara]

@AleksCee yes the websocket connection is being established with the Webex cloud and there is no agent in between the SDK and the Webex cloud. This error is logged when the KMS plugin is unable to validate the domain name of the JWT. Something is different about the JWT which is leading to the failure of the CN validation. Do you have any logs and HAR files for this problem?

[Ramseythegreyed]

Your bot connects fine (auth + websocket OK).
The crash on first message is almost certainly a TLS/certificate validation issue in your environment, not Webex.

What’s happening
• "Hostname of 1st certificate does not match 'kid'" = Node TLS mismatch
• Common causes:
• Corporate HTTPS/TLS inspection (proxy/MITM)
• Missing enterprise root CA in Node
• Less likely: SDK/framework bug

Key point

Webex does not use different certificates for corporate spaces.
Your bot still talks to standard Webex cloud endpoints.

Fix (securely)
• Test outside corporate network → confirms proxy issue
• Add enterprise root CA via NODE_EXTRA_CA_CERTS
• Check HTTPS_PROXY / outbound proxy config
• Update webex-node-bot-framework and dependencies

Don’t do this
• Do not set NODE_TLS_REJECT_UNAUTHORIZED=0 (breaks TLS security)

Bottom line

SDK is fine. Fix TLS trust in your runtime, not Webex config.

⸻