Fix SSL Certificate Errors: NET::ERR_CERT Codes

Browser certificate warnings all look alike to visitors—"Your connection is not private"—but the causes behind them are quite different, and so are the fixes. Here are the ones you will meet most often, how to recognise each, and what to change.

Is it you or the website? If the error appears on one device only, check that device's date and time, and any antivirus or company network that inspects HTTPS traffic. If it appears for everyone, on every network, the problem is the site's certificate or server configuration, and only the site owner can fix it.

NET::ERR_CERT_COMMON_NAME_INVALID: name mismatch

Browser message: NET::ERR_CERT_COMMON_NAME_INVALID, "certificate is not valid for this name".

The hostname in the address bar isn't among the names on the certificate. Typical causes:

• The certificate covers www.example.com but not example.com, or the other way round.
• A wildcard is expected to cover too much. *.example.com does not cover example.com itself, or two-level names such as api.eu.example.com.
• The hostname points at a shared server or CDN that has no certificate for it, so it serves its default certificate instead.

Fix: issue a certificate that lists every hostname visitors use, or point the hostname at the server that holds the right certificate.

"Unable to get local issuer certificate": missing intermediate

Symptoms: the site works in Chrome on your desktop but fails in Firefox, on some phones, in curl ("unable to get local issuer certificate"), or for webhooks and API integrations.

The server sends its own certificate but not the intermediate that links it to a trusted root. Some browsers quietly download the missing intermediate or have it cached, which hides the problem from the people most likely to test the site. Clients that don't do this fail.

Fix: configure the server with the full chain. With Certbot that means fullchain.pem rather than cert.pem; with commercial certificates, append the CA bundle to your certificate file.

NET::ERR_CERT_DATE_INVALID: expired certificate

Browser message: NET::ERR_CERT_DATE_INVALID.

Either the certificate's end date has passed or, less often, the visitor's device clock is wrong. If many visitors report it, it is the certificate. An expired intermediate causes the same error even when your own certificate is current.

Fix: renew, reload the server, and find out why automation didn't do it—see SSL certificate expiry.

NET::ERR_CERT_AUTHORITY_INVALID: self-signed or private CA

Browser message: NET::ERR_CERT_AUTHORITY_INVALID.

The certificate wasn't issued by a publicly trusted CA. That happens with default certificates on routers, staging servers and appliances, and with certificates from a company's internal CA, which only trusted company devices accept.

Fix: for anything public, use a certificate from a public CA. Free automated options exist, so there is rarely a reason not to.

ERR_SSL_PROTOCOL_ERROR: handshake failure

Browser message: ERR_SSL_PROTOCOL_ERROR or ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

The browser and server couldn't agree on how to connect. Common causes are a server that only supports TLS 1.0 or 1.1 (which browsers no longer allow), no certificate configured for the requested hostname, or something other than HTTPS listening on port 443.

Fix: enable TLS 1.2 and 1.3, and make sure a certificate is configured for every hostname the server answers for.

ERR_CONNECTION_REFUSED on port 443

Browser message: ERR_CONNECTION_REFUSED.

This is not a certificate error at all: nothing is accepting HTTPS connections. Either HTTPS was never set up, the web server isn't running, or a firewall rejects port 443.

Mixed content

The padlock is missing or shows a warning even though the certificate is fine. The HTTPS page loads images, scripts or stylesheets over plain http://. Browsers block or flag these. Update the links to https://, or add the Content-Security-Policy: upgrade-insecure-requests header.

Diagnosing from the command line

To see exactly what a server presents:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Look at the certificate chain at the top and the Verify return code at the bottom. The SSL Certificate Checker runs the same test, names the specific problem, and gives the equivalent command for every connection it makes.