Certificate errors, explained

What “Your connection is not private” and its cousins actually mean, how to tell whether the problem is yours or the site’s, and how each one is fixed.

Updated 26 sept 20263 min read

Shown in English

This guide has not been translated into your language yet, so you are reading the English original. The rest of the site stays in the language you chose.

Before you run anything

These guides are reference material, not instructions for your particular network. Run commands only against networks you own or have explicit permission to examine — in many countries probing a network you are not authorised to touch is a criminal offence regardless of intent. Everything here is provided without warranty: you are responsible for what you run and for its effect on your systems.

A certificate warning means the browser could not confirm it is talking to the site it asked for. Sometimes the site is at fault; surprisingly often the problem is on the visitor’s side. The first job is working out which.

First: is it you or the site?

Check your device’s date and time. A clock that is days or years out makes every valid certificate look expired or not yet valid. This is the most common cause of errors on every site at once.
Is it every site, or one? Warnings everywhere point at your side: the clock, a Wi-Fi login page, or security software inspecting traffic. A warning on one site points at that site.
Try another network, such as mobile data. If the warning disappears, something on the first network is intercepting connections.
Check the site from outside. The SSL certificate check connects from our server rather than your device, so it shows what the site itself is serving.

The common errors

Chrome / Edge	Firefox	What it means
`NET::ERR_CERT_DATE_INVALID`	`SEC_ERROR_EXPIRED_CERTIFICATE`	Expired or not yet valid — or your clock is wrong.
`NET::ERR_CERT_COMMON_NAME_INVALID`	`SSL_ERROR_BAD_CERT_DOMAIN`	The certificate is for a different name.
`NET::ERR_CERT_AUTHORITY_INVALID`	`SEC_ERROR_UNKNOWN_ISSUER`	Signed by an authority the browser does not trust.
`ERR_SSL_VERSION_OR_CIPHER_MISMATCH`	`SSL_ERROR_NO_CYPHER_OVERLAP`	The server only offers old protocols the browser has dropped.
`NET::ERR_CERT_REVOKED`	`SEC_ERROR_REVOKED_CERTIFICATE`	The issuer has withdrawn the certificate.

What causes each one

Expired. Renewal did not happen. Certificates now last at most 200 days, falling to 47 days by 2029, so renewal has to be automatic — and an expired certificate usually means the automation broke quietly.

Wrong name. The certificate does not list the name in the address bar. Typical cases: it covers example.com but not www.example.com; a wildcard *.example.com covers shop.example.com but not example.com itself or a.b.example.com; or the name points at a server hosting other sites.

Untrusted authority. Three quite different causes share this error:

a self-signed certificate, common on routers, printers and internal tools;
an incomplete chain: the site did not send its intermediate certificate. Firefox reports this as an unknown issuer, and phones and apps often fail while Chrome on a desktop copes;
interception: antivirus “HTTPS scanning”, a corporate proxy or a hotel login page re-signing traffic with its own certificate.

Protocol mismatch. The server offers only TLS 1.0 or 1.1, which current browsers no longer accept.

If you run the site

Automate renewal, and monitor the expiry date separately — the check that renewal works is not the renewal job itself.
Serve the full chain. With most ACME clients this means pointing the server at the “fullchain” file, not the certificate alone.
Make the certificate cover every name you publish, with and without www.
Enable TLS 1.2 and 1.3 and nothing older.

If you are the visitor

On a site where you would type a password or card number, do not click through the warning. The warning is the browser telling you it cannot confirm who is on the other end — which is exactly the situation an attacker in the middle would create. Fix the clock, change networks or wait for the site to fix it.

All guides