When the Windows TLS implementation encounters an error during certificate validation, it prints the error as well as a hostname mismatch error. The mismatch error is convenient for diagnostics, because it lists the hostname that was expected as well as all compared SANs. However, if the validation error which occurred was not actually a mismatch, the error is misleading.