What the browser is comparing
Every certificate lists the hostnames it covers in a field called Subject Alternative Name. The browser compares the address in the address bar against that list. If it is not there, the connection is refused, regardless of how valid the certificate otherwise is.
The classic case is example.com and www.example.com. They are different hostnames and a certificate must list both. A site that works at one and fails at the other almost always has a certificate covering only one of them.
Wildcards cover less than people expect
A wildcard certificate for *.example.com covers www.example.com, api.example.com and shop.example.com. It does not cover example.com itself — the bare domain is a separate entry and has to be listed explicitly.
Wildcards are also only one level deep. *.example.com does not cover a.b.example.com. That needs its own wildcard at *.b.example.com.
The causes worth checking first
Serving the wrong certificate is as common as having the wrong one. If several sites share a server, a missing or misconfigured virtual host will hand out the default site's certificate to everybody.
A CDN or proxy in front of your origin terminates TLS with its own certificate, so the one your server holds may not be the one visitors see at all.
And after adding a new subdomain, the existing certificate does not automatically grow to cover it. It has to be reissued with the new name included.
Check your certificate → Expiry, chain, hostname match and weak signatures — free, no signupCommon questions
Does a wildcard certificate cover the root domain?
No. A certificate for *.example.com does not cover example.com. The bare domain must be listed as its own entry, which is why most wildcard certificates are issued for both.
Why does my site work with www but not without it?
The certificate lists one hostname and not the other. Reissue it covering both, and redirect one to the other so visitors only ever land on one.
Can I have one certificate for several domains?
Yes. A single certificate can list many unrelated hostnames in its Subject Alternative Name field, which is how most hosts serve multiple sites from one certificate.