webserver debugging ERROR: certificate common name 'myserver' doesn't match requested host name

Assuming the 'standard' config, ssl_access_log and ssl_request_log are written (in slightly different formats) for each HTTP request received on the TLS vhost. If the certificate is rejected, there is no TLS connection and it is not possible to send any HTTP request, so there is nothing to log.

Depending on the client program and TLS library it uses, it may detect the cert error during the handshake and send an alert, or it may detect it at the end of the handshake and just close the connection. If client does send an alert, that is logged in ssl_error_log IF you change LogLevel to info or lower, which is not the default. The client can't send the error message only an alert code, and there is no code specifically for 'wrong hostname', so client must choose among several that come close. However, the versions of wget I have -- on CentOS and Ubuntu -- use OpenSSL and do not send any alert, they just close, so nothing distinctive is logged.


No, it is not logged on the server. This check is made on the client, there is no way to know for the server if this problem occured or not.

You can (and should) configure a default VirtualHost that catches all requests to domains not matching your "real" VirtualHosts. That way you can find out if requests to your server are made with other hostnames. For that however you would need to configure a custom LogFormat, and I'm not quite sure if it is possible to log the server name of the request at all. The variable %{VARNAME}i looks promising though.

Edit: As Dave pointed out in the comments this will only work if an actual request is made to the server. Since the TLS handhake happens befor that, a user will have to manually override the security warning before any request actually takes place. As long as this doesn't happen, there is nothing Apache could log.