If a certificate doesn't have any valid names (so missing or empty subject alternative name extension), the error page will show "The certificate is only valid for ." (See e.g. https://198.89.122.189:2087/ although I don't know how long that will be like that).

In NetErrorChild.jsm, we have:

  let subjectAltNames = input.data.certSubjectAltNames.split(",");
  let numSubjectAltNames = subjectAltNames.length;
  let msgPrefix = "";
  if (numSubjectAltNames != 0) {
    if (numSubjectAltNames == 1) {
      if (newErrorPagesEnabled) {
        technicalInfo.textContent = "";
        let brandName = gBrandBundle.GetStringFromName("brandShortName");
        msgPrefix = gPipNSSBundle.formatStringFromName("certErrorMismatchSinglePrefix3", [brandName, hostString], 2) + " ";
        msgPrefix += gPipNSSBundle.GetStringFromName("certErrorMismatchSinglePrefix");
      } else {
        msgPrefix = gPipNSSBundle.GetStringFromName("certErrorMismatchSinglePrefix");
      }

If input.data.certSubjectAltNames is an empty string, calling split will actually return an array with one element, which means that numSubjectAltNames will be 1, which leads us down the wrong path.